Prevent form manipulation in PHP/JavaScript/JQuery

问题:

I have a form where users can buy credits with PayPal or banktransfer as payment option.

If a user selected "PayPal" as an option, the form data will be send to PayPal, using JQuery/JS:

$(':radio').change(function () {
var $this = $(this).val();
    if ($this === 'pp') {
    $('#form').attr('action','https://www.paypal.com/cgi-bin/webscr');  
     }           
    else
    {
    $('#form').attr('action','');  
    }
});

The user can also choose how much he wants to pay, which also selects how many credits he'll get from it. Additionally he can add a coupon-code. An Ajax-Request will check our database, if this is a valid coupon and grants the discount-value then.

All informations are stored in hidden input fields (what the price is, how many credits, how much discount (if any), user id, etc.). Now, I want to make sure that the user doesn't manipulate these values with Developer Tools or similiar things to pay less, use another user id and so on.

What would be the best possible way to prevent this form manipulation and receive the correct data? I assume it's kinda difficult because there are so much values to change.

回答1:

Data Forgery / Manipulation

There are many nefarious means of sending manipulated or forged data to a web server - cURL, Http Client (OSX app) just to name two that I use frequently when debugging. A determined attacker will send bad data to the HTTP server no matter what Javascript you think up.

Think outside the box

For security needs, it's time to break out of the mental model of using a web browser because it's a web site. As already stated, there are many ways to send data to an HTTP server.

Javascript is good for the UI and helping the user, but when it comes to securing your service against intentionally bad/wrong/malformed data, you must do that on the server.

Your particular problem

You may need to re-think using hidden form fields. One approach would be to use sessions to keep track of this info. If this is information that must be sent to PayPal in their form, there is a way to embed the PayPal form using encrypted data.

If you don't want to do this, the point of security then moves to the order processing code - look at the transaction details (currency amount, etc) before considering that a transaction is complete and valid.