Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #10353

Re: Validate Radio Buttons?

Show all headers | View raw

On 8/2/2013 8:06 PM, Twayne wrote:
> On 2013-08-01 10:10 PM, Jerry Stuckle wrote:
>> On 8/1/2013 9:25 PM, Christoph Michael Becker wrote:
>>> Jerry Stuckle wrote:
> ...
>>
>> Yes, it is quite simple to check the referrer.  However, that's a poor
>> thing to check, because it isn't a required field and may not be set.
>> Additionally, some firewalls/security products will strip the
>> HTTP_REFERER before sending the data (Norton has been famous for this in
>> the past - I don't know if they still do it).
>
> Yup!  No Referrer, no access! Wrong referrer, still no access. Spoof it
> properly or forget it. Along with other checks &k balances along the way
> of course.
>

Then you will lock out a number of valid users.  HTTP_REFERER is not a 
required field, and some firewalls will strip it from the header (Norton 
used to do this).

Plus it is so easy to spoof it isn't even funny.  I don't even need to 
use cURL to do it - I can do it with simple HTML.

>>
>> The result is checking HTTP_REFERER will keep out more valid users than
>> it will block hackers.
>
> That sounds like a bunch of bologna unless you can cite something
> verifiable to support it.

Please see above.

>     I have never, in over a decade, seen Referrer ever block anyone and
> I receive host reports of every single contact attempt on my site,
> successful or not. Daily.

Not that you know of, anyway.  But how do you know it was never blocked?

I've had some sites where the customer wants the referrer tracked.  We 
do, sand sometimes it comes up empty (even on a POST operation).

>     The only reason I don't have anything more cohesive to support my
> claim is that I lost a lot of memory due to a serious brain concussion a
> few years back, necessitating   re-learing a LOT of things, but I still
> have all my records in archive.

Which does not mean it does not occur.

>     Every contact is and was evaluated to see if I care why a contact
> attempt failed.  Being so near a college town, there are a lot of
> abandoned and unsuccessful access attempts. So far none have succeeded
> although it's been a long trip getting my knowledge back!
>

And you don't know how many spoofed entries there are, either.

> So if you can, please cite something to support your claim that it keeps
> out more valid users than bots & hackers & crackers.
>
>

See above.  HTTP_REFERER is NOT to be trusted.

Or google for it and see what else you find.

However, this is also off-topic in a PHP newsgroup.


-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Validate Radio Buttons? Twayne <nobody@spamcop.net> - 2013-07-31 14:20 -0400
  Re: Validate Radio Buttons? The Natural Philosopher <tnp@invalid.invalid> - 2013-07-31 20:00 +0100
    Re: Validate Radio Buttons? Twayne <nobody@spamcop.net> - 2013-08-01 17:11 -0400
  Re: Validate Radio Buttons? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-31 15:07 -0400
    Re: Validate Radio Buttons? Denis McMahon <denismfmcmahon@gmail.com> - 2013-07-31 21:37 +0000
      Re: Validate Radio Buttons? Twayne <nobody@spamcop.net> - 2013-08-01 16:47 -0400
        Re: Validate Radio Buttons? Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-01 17:25 -0400
          Re: Validate Radio Buttons? Twayne <nobody@spamcop.net> - 2013-08-01 17:53 -0400
            Re: Validate Radio Buttons? Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-01 19:50 -0400
    Re: Validate Radio Buttons? Twayne <nobody@spamcop.net> - 2013-08-01 17:16 -0400
      Re: Validate Radio Buttons? The Natural Philosopher <tnp@invalid.invalid> - 2013-08-02 00:40 +0100
        Re: Validate Radio Buttons? Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-01 20:09 -0400
        Re: Validate Radio Buttons? Twayne <nobody@spamcop.net> - 2013-08-02 19:42 -0400
          Re: Validate Radio Buttons? Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-02 19:56 -0400
            Re: Validate Radio Buttons? Twayne <nobody@spamcop.net> - 2013-08-04 11:57 -0400
              Re: Validate Radio Buttons? Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-04 22:06 -0400
                Re: Validate Radio Buttons? Twayne <nobody@spamcop.net> - 2013-08-05 11:17 -0400
                Re: Validate Radio Buttons? Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-05 11:33 -0400
      Re: Validate Radio Buttons? Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-01 19:53 -0400
        Re: Validate Radio Buttons? Christoph Michael Becker <cmbecker69@arcor.de> - 2013-08-02 03:25 +0200
          Re: Validate Radio Buttons? Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-01 22:10 -0400
            Re: Validate Radio Buttons? Twayne <nobody@spamcop.net> - 2013-08-02 20:06 -0400
              Re: Validate Radio Buttons? Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-02 20:20 -0400
          Re: Validate Radio Buttons? - LiveHTTP headers bill <william@TechServSys.com> - 2013-08-02 08:05 -0400
            Re: Validate Radio Buttons? - LiveHTTP headers The Natural Philosopher <tnp@invalid.invalid> - 2013-08-02 13:21 +0100
            Re: Validate Radio Buttons? - LiveHTTP headers Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-02 08:44 -0400
          Re: Validate Radio Buttons? Twayne <nobody@spamcop.net> - 2013-08-02 19:51 -0400
        Re: Validate Radio Buttons? Twayne <nobody@spamcop.net> - 2013-08-02 19:47 -0400
          Re: Validate Radio Buttons? Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-02 19:54 -0400
      Re: Validate Radio Buttons? Scott Johnson <noonehome@chalupasworld.com> - 2013-08-01 16:54 -0700
        Re: Validate Radio Buttons? Twayne <nobody@spamcop.net> - 2013-08-02 20:10 -0400
          Re: Validate Radio Buttons? Scott Johnson <noonehome@chalupasworld.com> - 2013-08-02 17:21 -0700
  Re: Validate Radio Buttons? RESOLVED Twayne <nobody@spamcop.net> - 2013-08-04 16:17 -0400

csiph-web