HTML - How to prevent user from editing form's value?

php webforms user-input
maomaopop picture maomaopop · May 29, 2011 · Viewed 7.7k times · Source

I am developing a simple web apps that allowed user to key in information using a form when I discovered I could edit that form's input default value using Chrome -> Check Element and submit the page with a different hacked value.

Code:

<input id="radioOk_100237" name="radio_100237" type="radio" checked="" value="0">

As normal, I load the page then using Google Chrome Check Element, I targeted this checkbox and changed the value to "9" before submitting it, in my background page, it reads "9" instead of pre-set value of "0" from this input element.

If every user changed the value and submit, it will completely thrashed my DB. How is this possible and am I supposed to encrypt the page or do something prior to submitting? I am totally lost, btw I am using PHP.

Answer

AJ. picture AJ. · May 29, 2011

For typical users, you can just add the attribute readonly to the form field(s).

For more advanced users/hackers that try to manipulate your server, you need to validate every piece of data that is submitted to ensure that tampering is caught and rejected. There is no client-side technique for this that is tamper-proof.

Related questions

Help me with a simple newsletter subscription form?

The newsletter subscription form I am working on can be found in the footer at this link. Currently, when the form is submitted, the error/success message displays on a new page. Instead I would like for the error/success …

Read More
How do I check if a string contains a specific word?

Consider: $a = 'How are you?'; if ($a contains 'are') echo 'true'; Suppose I have the code above, what is the correct way to write the statement if ($a contains 'are')?

Read More
Get the full URL in PHP

I use this code to get the full URL: $actual_link = 'http://'.$_SERVER['HTTP_HOST'].$_SERVER['PHP_SELF']; The problem is that I use some masks in my .htaccess, so what we see in the URL is not always …

Read More