Input form with hidden field how to secure it

问题:

After i knew how to secure upload image Bypassing forms input fields to upload unwanted files i would like to give another example of from with 2 filed, one of them are hidden.

SQL Table (id,name,jod,number)

CREATE TABLE `users` (
  `id` bigint(20) unsigned NOT NULL auto_increment,
  `name` varchar(255) default '0',
  `job` varchar(255) default NULL,
  `number` varchar(255) default NULL
) ENGINE=MyISAM DEFAULT CHARSET=utf8;

Form Code (support member will edit own informations)

<form action="send.php" method="post" name="send" id="send">
 <input type="text" name="name" id="name" value="John"/>
 <input type="text" name="job" id="job" value="Plumber"/>
 <input type=hidden name="number" id="number" value="1234"/>
 <input type="Submit" name="Submit" value="Submit"/>
</form>

Later there was an firefox extension that can bypassing different input to the server-side bypassing checking and might case a lot of damage so here it can stop the whole process and makes you able to edit the value of hidden table number to any such as value="1" causing update information for member have that value number 1.

That extension is working as following, It can fake input data before it passed to server side.

PHP Code Send.php

if(isset($_POST['send'])){  

$name   = mysql_real_escape_string($_POST[name]);
$job    = mysql_real_escape_string($_POST[job]);
$number = mysql_real_escape_string($_POST[number]);

$sql= "update users SET name='$name',job='$job' WHERE number='$number'";
       mysql_query($sql) or die("query failed: $sql".mysql_error());

echo "Update Done";

} else { 
echo "Nothing to update";
}

The question How then to protect this simple form from such input form ? ~ Thanks

this problems really hurts cause it made my website free to be hacked :)

回答1:

If the user authorization is not an option in your cause, you could try the following techniques:

• Set the hidden field with a hash of the number salted with some other information
• Set the hidden field with the number encrypted (possible salt could increase security here also)

Of course it would add extra steps when sending the form HTML and validating the post information, but at least it would be much harder to the attacker fake a valid number on the post. Although it would not save you if the attacker knows the encrypted/hashed number of a different user unless the salted information withing the hidden field is used wisely.

回答2:

You can't control what data people submit to your server.

You have to check, on the server, to see if the user is authorised to see the information or to make the change they are asking for.

For example:

able to edit the value of hidden table number to any such as value="1" causing update information for member have that value number 1.

The process would be something like:

1. Is anybody allowed to edit this field? If so, then OK.
2. Is the request coming from an authenticated user? If not, then return an error message and a login form
3. Is the request coming from the user with id=1? If so, then OK
4. If the request coming from a user who has admin permissions? If so, then OK
5. Return an error message.

回答3:

If you have a form and any users to edit the values, this problem is going to be there. A better approach is to authenticate the users. Allow only the users who have logged in with an account to make the changes to their respective accounts.

Also, don't use mysql_query or anything like mysql_*, they are insecure and depreciated in php5.