Continually Improving.... let us know how support@devdiamond.net Sign in | Sign up
home articles news blog forum  

 
 


 
Skip Navigation LinksHome > Article > TIPS :: Protect your forms, from people playing around
TIPS :: Protect your forms, from people playing around
Abstract :
Protect your forms, check for the required fields of a form from the submission page to prevent people from playing around your code.

Views : 720
Published : Monday, March 18, 2002
By
HyperLink

Avarage Rating :
Page Page 1 of 1

I assume that you have a form that requires some information to be entered for the form to proceed, and let's spouse that you do check if required fields are empty or not using JavaScript or any other Client-Side scripting technology.

Problem # 1

with Client-Side scripting language the user's browser must support that language for your script to run, so if user doesn't have a JavaScript enabled (for example) browser your script will not work, this will allow users easily to submit the form without those required fields, causing errors that

  1. give false impression that your web is not working
  2. those errors can be useful for hackers especially when they contains physical locations like C:\folder\file.asp

Problem # 2

Some people can also play around your code they can make there own forms pointing at your submission page, so they can get errors

Solution

To prevent users from getting these errors you can make the page which actually submit the form checks if those required fields are empty or not first before submitting them, and you will also add some values (like N/A) to non-Required fields, this make sense cause even if guys try playing around your form they have to submit that form at last to your submission page, Otherwise they will not make problems.

Examples

Our Examples are in ASP, but you can use the concept with any other language

For Required Fields
strName = Request.Form("Name")
If strName = "" Then
response.write "Please enter your Name then try again."
End If

For non-Required Fields
strPhone = Request.Form("Phone")
If strPhone = "" Then
strPhone = "N/A"
End If

I welcome any feedback, comments, suggestions form you at yasir@minwar.com Please tell me what would you like to see here next week.



About Author

        Yasir Send Feedback
        Yasir is a .NET expert, with over 5 years experience in Microsoft Technologies, 8 years overall programming experience, he is the owner, founder & primary contributor of Minwar.com, and he also works as IT Director in the hospitality industry.