Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #10320 > unrolled thread

Validate Radio Buttons?

Back to article view | Back to comp.lang.php

Contents

  Validate Radio Buttons? Twayne <nobody@spamcop.net> - 2013-07-31 14:20 -0400
    Re: Validate Radio Buttons? The Natural Philosopher <tnp@invalid.invalid> - 2013-07-31 20:00 +0100
      Re: Validate Radio Buttons? Twayne <nobody@spamcop.net> - 2013-08-01 17:11 -0400
    Re: Validate Radio Buttons? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-31 15:07 -0400
      Re: Validate Radio Buttons? Denis McMahon <denismfmcmahon@gmail.com> - 2013-07-31 21:37 +0000
        Re: Validate Radio Buttons? Twayne <nobody@spamcop.net> - 2013-08-01 16:47 -0400
          Re: Validate Radio Buttons? Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-01 17:25 -0400
            Re: Validate Radio Buttons? Twayne <nobody@spamcop.net> - 2013-08-01 17:53 -0400
              Re: Validate Radio Buttons? Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-01 19:50 -0400
      Re: Validate Radio Buttons? Twayne <nobody@spamcop.net> - 2013-08-01 17:16 -0400
        Re: Validate Radio Buttons? The Natural Philosopher <tnp@invalid.invalid> - 2013-08-02 00:40 +0100
          Re: Validate Radio Buttons? Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-01 20:09 -0400
          Re: Validate Radio Buttons? Twayne <nobody@spamcop.net> - 2013-08-02 19:42 -0400
            Re: Validate Radio Buttons? Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-02 19:56 -0400
              Re: Validate Radio Buttons? Twayne <nobody@spamcop.net> - 2013-08-04 11:57 -0400
                Re: Validate Radio Buttons? Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-04 22:06 -0400
                  Re: Validate Radio Buttons? Twayne <nobody@spamcop.net> - 2013-08-05 11:17 -0400
                    Re: Validate Radio Buttons? Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-05 11:33 -0400
        Re: Validate Radio Buttons? Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-01 19:53 -0400
          Re: Validate Radio Buttons? Christoph Michael Becker <cmbecker69@arcor.de> - 2013-08-02 03:25 +0200
            Re: Validate Radio Buttons? Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-01 22:10 -0400
              Re: Validate Radio Buttons? Twayne <nobody@spamcop.net> - 2013-08-02 20:06 -0400
                Re: Validate Radio Buttons? Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-02 20:20 -0400
            Re: Validate Radio Buttons? - LiveHTTP headers bill <william@TechServSys.com> - 2013-08-02 08:05 -0400
              Re: Validate Radio Buttons? - LiveHTTP headers The Natural Philosopher <tnp@invalid.invalid> - 2013-08-02 13:21 +0100
              Re: Validate Radio Buttons? - LiveHTTP headers Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-02 08:44 -0400
            Re: Validate Radio Buttons? Twayne <nobody@spamcop.net> - 2013-08-02 19:51 -0400
          Re: Validate Radio Buttons? Twayne <nobody@spamcop.net> - 2013-08-02 19:47 -0400
            Re: Validate Radio Buttons? Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-02 19:54 -0400
        Re: Validate Radio Buttons? Scott Johnson <noonehome@chalupasworld.com> - 2013-08-01 16:54 -0700
          Re: Validate Radio Buttons? Twayne <nobody@spamcop.net> - 2013-08-02 20:10 -0400
            Re: Validate Radio Buttons? Scott Johnson <noonehome@chalupasworld.com> - 2013-08-02 17:21 -0700
    Re: Validate Radio Buttons? RESOLVED Twayne <nobody@spamcop.net> - 2013-08-04 16:17 -0400

Page 1 of 2  [1] 2  Next page →

#10320 — Validate Radio Buttons?

Hi all,

I was wondering what the general consensus might be on this:

Should one Validate Radio Buttons for an online website contact form?

I've always thought they needed nothing but validation to see if they'd 
been used or not before accepting them, and sending the user back to the 
website Home Page.
    I've used Referrer to check the pages the visitor came from, gotten 
his IP or proxy identifier IP and used Control Cache and Pragma plus 
$referrer to check that the visitor arrived from the website and nowhere 
else,  to try to be sure you can't go back to any previous page and find 
the data still in tact; sessions are always destroyed when any error 
shows up.  A counter tells  me how many attempts were made from the same 
IP or Proxy and after 3 attempts the visitor is banned for a few hours. 
Two sets of 3 failed attempts will ge him banned permanently.

BUT, does any of that negate the need to Validate a Radio Button Click?
http://phpmaster.com/form-validation-with-php/ seems to think so, but 
the code they suggest isn't exactly simple and it takes a lot of code.

I'm willing to be called wrong; no problem at all.

So, what do YOU think?

TIA & Regards,

Twayne`

[toc] | [next] | [standalone]

#10321

On 31/07/13 19:20, Twayne wrote:
> Hi all,
>
> I was wondering what the general consensus might be on this:
>
> Should one Validate Radio Buttons for an online website contact form?
>
> I've always thought they needed nothing but validation to see if 
> they'd been used or not before accepting them, and sending the user 
> back to the website Home Page.
>    I've used Referrer to check the pages the visitor came from, gotten 
> his IP or proxy identifier IP and used Control Cache and Pragma plus 
> $referrer to check that the visitor arrived from the website and 
> nowhere else,  to try to be sure you can't go back to any previous 
> page and find the data still in tact; sessions are always destroyed 
> when any error shows up.  A counter tells  me how many attempts were 
> made from the same IP or Proxy and after 3 attempts the visitor is 
> banned for a few hours. Two sets of 3 failed attempts will ge him 
> banned permanently.
>
> BUT, does any of that negate the need to Validate a Radio Button Click?
> http://phpmaster.com/form-validation-with-php/ seems to think so, but 
> the code they suggest isn't exactly simple and it takes a lot of code.
>
> I'm willing to be called wrong; no problem at all.
>
> So, what do YOU think?
>
I think really only you can answer this one.
Think what would happen in a user somehow faked everything and sent out 
of bounds data. Or sql injection type code instead of what was supposed 
to be in the post variable.

One simple way to get rid of most malware is to cast explictily or 
implicitly, all variables to integers,

So for example if you were setting an SQL field to a numeric value based 
on user response, I normally would use sprintf to prepare the query with 
%d representing an integer value, into an ID or an enumerated field. Out 
of bounds data is simply then an error and no further validation is 
rquired, unless you want to send the error back to the user, which n te 
case of a radio button is pointlss because you woat GET error data 
unless they have actively faked the entry.

Any data that falls into a few well defined entries only, is easy to 
validate. The problem comes when you allow arbitrary string entry.
Then SQL injection can happen if a really nasty string is concocted, but 
even then php supplies tools to sanitise just about anything you throw 
at it, up to and including (as I discovered) turning strings into 
hecadecimal numbers and inserting THOSE into the database. Assuming you 
are working with a database.

One of the best ways to approach design to put on a black hat and try 
and crack it yourself. Think when you code 'what would happen if..there 
was no data at all, the data contained special characters you really 
wouldn't expect?

Another thought is 'don't bother putting bars on the windows if you 
leave the front door open' the easiest way to hack a website is to find 
the administrative portal and hack past the password. Too many people 
leave the default settings in place when they install code written by 
others. Don't.




> TIA & Regards,
>
> Twayne`


-- 
Ineptocracy

(in-ep-toc’-ra-cy) – a system of government where the least capable to lead are elected by the least capable of producing, and where the members of society least likely to sustain themselves or succeed, are rewarded with goods and services paid for by the confiscated wealth of a diminishing number of producers.

[toc] | [prev] | [next] | [standalone]

#10327

On 2013-07-31 3:00 PM, The Natural Philosopher wrote:
> On 31/07/13 19:20, Twayne wrote:
>> Hi all,
>>
>> I was wondering what the general consensus might be on this:
>>
>> Should one Validate Radio Buttons for an online website contact form?
>>
...

>>
>> So, what do YOU think?
>>
> I think really only you can answer this one.
> Think what would happen in a user somehow faked everything and sent out
> of bounds data. Or sql injection type code instead of what was supposed
> to be in the post variable.

I'm trying! :)

One thing I have learned is that I'm woefully ignorant of those 
processes and thus am fighting something I have little knowledge of. I'm 
working on solutions to that issue too.

>
> One simple way to get rid of most malware is to cast explictily or
> implicitly, all variables to integers,

THAT sounds like a good idea! Why didn't I think of that?  But it does 
bring a possibly stupid question: If I've been hit with XSS or some kind 
of injection, might it already have done its damage by the time I get to 
be able to process the cast to numeric?
    And more specifically, how could a single-digit result from a Radio 
Button contain anything harmful as long as I check that it's in bounds?
    I realize that's possibly outside the scope of this group, but 
thought I'd ask anyway. No problem if you ignore it.

>
> So for example if you were setting an SQL field to a numeric value based
> on user response, I normally would use sprintf to prepare the query with
> %d representing an integer value, into an ID or an enumerated field. Out
> of bounds data is simply then an error and no further validation is
> rquired, unless you want to send the error back to the user, which n te
> case of a radio button is pointlss because you woat GET error data
> unless they have actively faked the entry.

Makes sense.

>
> Any data that falls into a few well defined entries only, is easy to
> validate. The problem comes when you allow arbitrary string entry.
> Then SQL injection can happen if a really nasty string is concocted, but
> even then php supplies tools to sanitise just about anything you throw
> at it, up to and including (as I discovered) turning strings into
> hecadecimal numbers and inserting THOSE into the database. Assuming you
> are working with a database.

No DB yet, but I do plan to add it after learning it well enough. I'm 
primarily interested in radio button validation at the moment.
>
> One of the best ways to approach design to put on a black hat and try
> and crack it yourself. Think when you code 'what would happen if..there
> was no data at all, the data contained special characters you really
> wouldn't expect?

I've tried that, and so have a couple of buddy coders, and to date no 
one has managed to get thru. But that's not a very large segment of 
people and they're admittedly not the best code breakers around.
>
> Another thought is 'don't bother putting bars on the windows if you
> leave the front door open' the easiest way to hack a website is to find
> the administrative portal and hack past the password. Too many people
> leave the default settings in place when they install code written by
> others. Don't.

Nope, I don't, or I do my best not to, at least.  <g>  One of the pieces 
of code I'm most proud of so far is the generation of the temporary 
access code every visitor is given when he starts to fill out the form. 
It's been judged better than "average" at PHPBuilder, NAS, Tizag and 
here too if I'm not mistaken.  It's a good ego boost and probably the 
best first line of defense, but nothing can ever be 100% safe as we all 
know.
>
>
Regards,

Twayne`

[toc] | [prev] | [next] | [standalone]

#10322

On 7/31/2013 2:20 PM, Twayne wrote:
> Hi all,
>
> I was wondering what the general consensus might be on this:
>
> Should one Validate Radio Buttons for an online website contact form?
>
> I've always thought they needed nothing but validation to see if they'd
> been used or not before accepting them, and sending the user back to the
> website Home Page.
>     I've used Referrer to check the pages the visitor came from, gotten
> his IP or proxy identifier IP and used Control Cache and Pragma plus
> $referrer to check that the visitor arrived from the website and nowhere
> else,  to try to be sure you can't go back to any previous page and find
> the data still in tact; sessions are always destroyed when any error
> shows up.  A counter tells  me how many attempts were made from the same
> IP or Proxy and after 3 attempts the visitor is banned for a few hours.
> Two sets of 3 failed attempts will ge him banned permanently.
>
> BUT, does any of that negate the need to Validate a Radio Button Click?
> http://phpmaster.com/form-validation-with-php/ seems to think so, but
> the code they suggest isn't exactly simple and it takes a lot of code.
>
> I'm willing to be called wrong; no problem at all.
>
> So, what do YOU think?
>
> TIA & Regards,
>
> Twayne`

Good practice means you ALWAYS validate ALL information from the user. 
You may have a radio button on your form - but there is no guarantee the 
request comes on from your form.

I can easily build a page which has invalid information and submit it to 
your site.  Or even use tools like cURL to feed your site invalid 
information.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#10323

On Wed, 31 Jul 2013 15:07:17 -0400, Jerry Stuckle wrote:

> On 7/31/2013 2:20 PM, Twayne wrote:

>> Should one Validate Radio Buttons for an online website contact form?

> Good practice means you ALWAYS validate ALL information from the user.
> You may have a radio button on your form - but there is no guarantee the
> request comes on from your form.

As a follow up to Jerry, radio buttons and select lists are probably the 
easiest elements to validate in the server side code because, by 
definition, you expect them to be one of a discrete set of values, and if 
they're not a member of that set of values, then someone is playing silly 
buggers.

You could use in_array to check that the value received is in an array of 
expected values, and then use the value directly; or you could switch on 
the value received, with a case for each of the expected values. In both 
cases, you can detect and respond as you feel appropriate for unexpected 
values.

-- 
Denis McMahon, denismfmcmahon@gmail.com

[toc] | [prev] | [next] | [standalone]

#10326

On 2013-07-31 5:37 PM, Denis McMahon wrote:
> On Wed, 31 Jul 2013 15:07:17 -0400, Jerry Stuckle wrote:
>
>> On 7/31/2013 2:20 PM, Twayne wrote:
>
>>> Should one Validate Radio Buttons for an online website contact form?
>
>> Good practice means you ALWAYS validate ALL information from the user.
>> You may have a radio button on your form - but there is no guarantee the
>> request comes on from your form.
>
> As a follow up to Jerry, radio buttons and select lists are probably the
> easiest elements to validate in the server side code because, by
> definition, you expect them to be one of a discrete set of values, and if
> they're not a member of that set of values, then someone is playing silly
> buggers.

Well ... that's why I thought it wasn't much necessary other than to see 
they were in the range I wanted and weren't empty. They're all 
single-character results, 0 thru 9, and 0 thru 3 in one case, and I 
thought all I needed to do was validate them to be within the ranges I 
specified or throw an error otherwise.
    I wondered though, if errant data came in, would it be possible to 
hurt me before I did the checks on them?
    Today I wrote a couple of functions to check things with; one for 
nearly all data and a slightly less stringent one to allow a URL to 
appear within a textarea.
    the major commonly used function consists of
--------------
function checkIt_1($data)
     $data = trim($data);
     $data = stripslashes($data);
     $data = strip_tags( $data);
     $data = htmlspecialchars($data);
     return $data;
-------------
With that I'm still able to read any munged text due to the function 
although if the visitor saw it it might be pretty confusing to him. It's 
not an issue to me though. I even run the functions on my SESSIONs data 
when I call it in, just in case it somehow was tainted.

    So ... if I applied that function or one similar to it, would you 
say I've made a step in the right direction or have I wasted my time?

    Is the stripslashes worth the machine cycles or does it just waste 
time?
    I've also thought about using htmlentities but it seems a little 
redundant.  Yes?

I'm pretty ignorant yet on just how XSS and the various injection 
methods work although I now have a couple of what I think are good sites 
to read through. It's taken me a long time to find easy-to-read 
tutorials or instructions for absolute beginners like I am in that area, 
  on those subjects; there's SO much junk around it's sometimes pretty 
difficult to tell whether an author knows what he's talking about or not.

>
> You could use in_array to check that the value received is in an array of
> expected values, and then use the value directly; or you could switch on
> the value received, with a case for each of the expected values. In both
> cases, you can detect and respond as you feel appropriate for unexpected
> values.
>

Arrays are probably a good idea but for me if they're not straight-up 
1-dimensional arrays I get easily mixed up keeping track of their 
contents. Last time I tried I ended up leaving some holes that even I 
knew better than to do <grin>.

Thanks for all the food for thought, and allowing me to explain a bit 
about what's up.

Anything further anyone has to add here is most welcome. I also respond 
promptly to any & all question/clarifications anyone may want.

Best regards,

Twayne`

[toc] | [prev] | [next] | [standalone]

#10329

On 8/1/2013 4:47 PM, Twayne wrote:
> On 2013-07-31 5:37 PM, Denis McMahon wrote:
>> On Wed, 31 Jul 2013 15:07:17 -0400, Jerry Stuckle wrote:
>>
>>> On 7/31/2013 2:20 PM, Twayne wrote:
>>
>>>> Should one Validate Radio Buttons for an online website contact form?
>>
>>> Good practice means you ALWAYS validate ALL information from the user.
>>> You may have a radio button on your form - but there is no guarantee the
>>> request comes on from your form.
>>
>> As a follow up to Jerry, radio buttons and select lists are probably the
>> easiest elements to validate in the server side code because, by
>> definition, you expect them to be one of a discrete set of values, and if
>> they're not a member of that set of values, then someone is playing silly
>> buggers.
>
> Well ... that's why I thought it wasn't much necessary other than to see
> they were in the range I wanted and weren't empty. They're all
> single-character results, 0 thru 9, and 0 thru 3 in one case, and I
> thought all I needed to do was validate them to be within the ranges I
> specified or throw an error otherwise.
>     I wondered though, if errant data came in, would it be possible to
> hurt me before I did the checks on them?

If you don't use the data before validating it, there isn't much bad 
data can do (other than maybe a buffer overrun - which would be an 
Apache/PHP problem).

>     Today I wrote a couple of functions to check things with; one for
> nearly all data and a slightly less stringent one to allow a URL to
> appear within a textarea.
>     the major commonly used function consists of
> --------------
> function checkIt_1($data)
>      $data = trim($data);
>      $data = stripslashes($data);
>      $data = strip_tags( $data);
>      $data = htmlspecialchars($data);
>      return $data;
> -------------

Why are you calling stripslashes()?  You should have magic_quotes_gpc() 
off (for years now), which makes this function unnecessary (and 
potentially harmful by removing slashes it shouldn't).

I'm not sure why you would want to strip the tags then encode the html 
characters, but whatever suits your needs.

> With that I'm still able to read any munged text due to the function
> although if the visitor saw it it might be pretty confusing to him. It's
> not an issue to me though. I even run the functions on my SESSIONs data
> when I call it in, just in case it somehow was tainted.
>

Should not be necessary on your $_SESSION array, since that never leaves 
the server.  You will get back exactly what you store there.

>     So ... if I applied that function or one similar to it, would you
> say I've made a step in the right direction or have I wasted my time?
>

Radio buttons need different validation - just check to see if the value 
is one of the valid ones for that particular button.

>     Is the stripslashes worth the machine cycles or does it just waste
> time?
>     I've also thought about using htmlentities but it seems a little
> redundant.  Yes?
>

See previous comments.  The question is - what exactly are you trying to 
accomplish?

> I'm pretty ignorant yet on just how XSS and the various injection
> methods work although I now have a couple of what I think are good sites
> to read through. It's taken me a long time to find easy-to-read
> tutorials or instructions for absolute beginners like I am in that area,
>   on those subjects; there's SO much junk around it's sometimes pretty
> difficult to tell whether an author knows what he's talking about or not.
>

Yes, there are a lot of bad tutorials, recommendations and other 
documents available on the 'net - much more than there is good 
documentation.

>>
>> You could use in_array to check that the value received is in an array of
>> expected values, and then use the value directly; or you could switch on
>> the value received, with a case for each of the expected values. In both
>> cases, you can detect and respond as you feel appropriate for unexpected
>> values.
>>
>
> Arrays are probably a good idea but for me if they're not straight-up
> 1-dimensional arrays I get easily mixed up keeping track of their
> contents. Last time I tried I ended up leaving some holes that even I
> knew better than to do <grin>.
>

A one-dimensional array is fine for this, and is an easy way to validate 
the value in a radio button.

> Thanks for all the food for thought, and allowing me to explain a bit
> about what's up.
>
> Anything further anyone has to add here is most welcome. I also respond
> promptly to any & all question/clarifications anyone may want.
>
> Best regards,
>
> Twayne`
>
>
>
>
>



-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#10331

On 2013-08-01 5:25 PM, Jerry Stuckle wrote:
> On 8/1/2013 4:47 PM, Twayne wrote:
>> On 2013-07-31 5:37 PM, Denis McMahon wrote:
>>> On Wed, 31 Jul 2013 15:07:17 -0400, Jerry Stuckle wrote:
>>>
>>>> On 7/31/2013 2:20 PM, Twayne wrote:
>>>
>>>>> Should one Validate Radio Buttons for an online website contact form?
>>>
>>>> Good practice means you ALWAYS validate ALL information from the user.
>>>> You may have a radio button on your form - but there is no guarantee
>>>> the
>>>> request comes on from your form.
>>>
>>> As a follow up to Jerry, radio buttons and select lists are probably the
>>> easiest elements to validate in the server side code because, by
>>> definition, you expect them to be one of a discrete set of values,
>>> and if
>>> they're not a member of that set of values, then someone is playing
>>> silly
>>> buggers.
>>

...

>
> If you don't use the data before validating it, there isn't much bad
> data can do (other than maybe a buffer overrun - which would be an
> Apache/PHP problem).

Ah! Agreed; had a short black-out there! understood.
>
>>     Today I wrote a couple of functions to check things with; one for
>> nearly all data and a slightly less stringent one to allow a URL to
>> appear within a textarea.
>>     the major commonly used function consists of
>> --------------
>> function checkIt_1($data)
>>      $data = trim($data);
>>      $data = stripslashes($data);
>>      $data = strip_tags( $data);
>>      $data = htmlspecialchars($data);
>>      return $data;
>> -------------
>
> Why are you calling stripslashes()?  You should have magic_quotes_gpc()
> off (for years now), which makes this function unnecessary (and
> potentially harmful by removing slashes it shouldn't).

Magic quotes are off; thanks for the tip. I've misunderstood something 
there so I'll go recheck what stripslashes does.

>
> I'm not sure why you would want to strip the tags then encode the html
> characters, but whatever suits your needs.
>
>> With that I'm still able to read any munged text due to the function
>> although if the visitor saw it it might be pretty confusing to him. It's
>> not an issue to me though. I even run the functions on my SESSIONs data
>> when I call it in, just in case it somehow was tainted.
>>
>
> Should not be necessary on your $_SESSION array, since that never leaves
> the server.  You will get back exactly what you store there.
>
>>     So ... if I applied that function or one similar to it, would you
>> say I've made a step in the right direction or have I wasted my time?
>>
>
> Radio buttons need different validation - just check to see if the value
> is one of the valid ones for that particular button.

Ah, finally; I did something right!
>
>>     Is the stripslashes worth the machine cycles or does it just waste
>> time?
>>     I've also thought about using htmlentities but it seems a little
>> redundant.  Yes?
>>
>
> See previous comments.  The question is - what exactly are you trying to
> accomplish?
>
... there's SO much junk around it's sometimes pretty

>> difficult to tell whether an author knows what he's talking about or not.
>>
>
> Yes, there are a lot of bad tutorials, recommendations and other
> documents available on the 'net - much more than there is good
> documentation.
>
>>>
...

>>>
>>
>> Arrays are probably a good idea but for me if they're not straight-up
>> 1-dimensional arrays I get easily mixed up keeping track of their
>> contents. Last time I tried I ended up leaving some holes that even I
>> knew better than to do <grin>.
>>
>
> A one-dimensional array is fine for this, and is an easy way to validate
> the value in a radio button.
>

Regards,

Twayne`

[toc] | [prev] | [next] | [standalone]

#10333

On 8/1/2013 5:53 PM, Twayne wrote:
> On 2013-08-01 5:25 PM, Jerry Stuckle wrote:

>> See previous comments.  The question is - what exactly are you trying to
>> accomplish?
>>
> ... there's SO much junk around it's sometimes pretty
>

That doesn't answer the question.  What exactly are you trying to 
accomplish?

A text field can contain a lot of things.  How you validate the field 
depends entirely on what you expect in the field.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#10328

On 2013-07-31 3:07 PM, Jerry Stuckle wrote:
> On 7/31/2013 2:20 PM, Twayne wrote:
>> Hi all,
>>
>> I was wondering what the general consensus might be on this:
>>
>> Should one Validate Radio Buttons for an online website contact form?
>>
...

>
> Good practice means you ALWAYS validate ALL information from the user.
> You may have a radio button on your form - but there is no guarantee the
> request comes on from your form.
>
> I can easily build a page which has invalid information and submit it to
> your site.  Or even use tools like cURL to feed your site invalid
> information.
>

Care to share the "how" of doing that, or better yet some code? This 
particular form isn't "live" yet or I'd put it somewhere and let you at 
it if I didn't have orders to the contrary from on-high :)
    I've done my best but it's obviously not enough or my questions 
wouldn't exist.

Regards,

Twayne`

[toc] | [prev] | [next] | [standalone]

#10332

On 01/08/13 22:16, Twayne wrote:
> On 2013-07-31 3:07 PM, Jerry Stuckle wrote:
>> On 7/31/2013 2:20 PM, Twayne wrote:
>>> Hi all,
>>>
>>> I was wondering what the general consensus might be on this:
>>>
>>> Should one Validate Radio Buttons for an online website contact form?
>>>
> ...
>
>>
>> Good practice means you ALWAYS validate ALL information from the user.
>> You may have a radio button on your form - but there is no guarantee the
>> request comes on from your form.
>>
>> I can easily build a page which has invalid information and submit it to
>> your site.  Or even use tools like cURL to feed your site invalid
>> information.
>>
>
> Care to share the "how" of doing that, or better yet some code? This 
> particular form isn't "live" yet or I'd put it somewhere and let you 
> at it if I didn't have orders to the contrary from on-high :)
>    I've done my best but it's obviously not enough or my questions 
> wouldn't exist.
>

In three years of reading this group I have never seen his highness lord 
Stuckle post a single line of PHP.

> Regards,
>
> Twayne`


-- 
Ineptocracy

(in-ep-toc’-ra-cy) – a system of government where the least capable to lead are elected by the least capable of producing, and where the members of society least likely to sustain themselves or succeed, are rewarded with goods and services paid for by the confiscated wealth of a diminishing number of producers.

[toc] | [prev] | [next] | [standalone]

#10336

On 8/1/2013 7:40 PM, The Natural Philosopher wrote:
> On 01/08/13 22:16, Twayne wrote:
>> On 2013-07-31 3:07 PM, Jerry Stuckle wrote:
>>> On 7/31/2013 2:20 PM, Twayne wrote:
>>>> Hi all,
>>>>
>>>> I was wondering what the general consensus might be on this:
>>>>
>>>> Should one Validate Radio Buttons for an online website contact form?
>>>>
>> ...
>>
>>>
>>> Good practice means you ALWAYS validate ALL information from the user.
>>> You may have a radio button on your form - but there is no guarantee the
>>> request comes on from your form.
>>>
>>> I can easily build a page which has invalid information and submit it to
>>> your site.  Or even use tools like cURL to feed your site invalid
>>> information.
>>>
>>
>> Care to share the "how" of doing that, or better yet some code? This
>> particular form isn't "live" yet or I'd put it somewhere and let you
>> at it if I didn't have orders to the contrary from on-high :)
>>    I've done my best but it's obviously not enough or my questions
>> wouldn't exist.
>>
>
> In three years of reading this group I have never seen his highness lord
> Stuckle post a single line of PHP.
>

That's because you can't read.  The Google archives will easily prove 
you wrong.

OTOH, I have yet to see you post anything RIGHT - code or otherwise. 
And the Google archives will prove that right.

>> Regards,
>>
>> Twayne`
>
>



-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#10346

On 2013-08-01 7:40 PM, The Natural Philosopher wrote:
> On 01/08/13 22:16, Twayne wrote:
>> On 2013-07-31 3:07 PM, Jerry Stuckle wrote:
>>> On 7/31/2013 2:20 PM, Twayne wrote:
>>>> Hi all,
>>>>
>>>> I was wondering what the general consensus might be on this:
>>>>
>>>> Should one Validate Radio Buttons for an online website contact form?
>>>>
>> ...
>>
>
> In three years of reading this group I have never seen his highness lord
> Stuckle post a single line of PHP.
>
>> Regards,
>>
>> Twayne`
>
>

I have, but not very often. He can be pretty eccentric at times, but; 
what's your beef? You are off-topic; please get back on.

[toc] | [prev] | [next] | [standalone]

#10350

On 8/2/2013 7:42 PM, Twayne wrote:
> On 2013-08-01 7:40 PM, The Natural Philosopher wrote:
>> On 01/08/13 22:16, Twayne wrote:
>>> On 2013-07-31 3:07 PM, Jerry Stuckle wrote:
>>>> On 7/31/2013 2:20 PM, Twayne wrote:
>>>>> Hi all,
>>>>>
>>>>> I was wondering what the general consensus might be on this:
>>>>>
>>>>> Should one Validate Radio Buttons for an online website contact form?
>>>>>
>>> ...
>>>
>>
>> In three years of reading this group I have never seen his highness lord
>> Stuckle post a single line of PHP.
>>
>>> Regards,
>>>
>>> Twayne`
>>
>>
>
> I have, but not very often. He can be pretty eccentric at times, but;
> what's your beef? You are off-topic; please get back on.

How much PHP code have you seen here recently?   How much *correct& PHP 
code has been posted by TNP? 	

I've posted a lot of code in the past.   Unfortunately, due to trolls 
like TNP, this newsgroup has pretty much died so there is little reason 
to post any code.

Fortunately, there are a few web forums which still have good PHP 
discussions.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#10384

On 2013-08-02 7:56 PM, Jerry Stuckle wrote:
> On 8/2/2013 7:42 PM, Twayne wrote:
>> On 2013-08-01 7:40 PM, The Natural Philosopher wrote:
>>> On 01/08/13 22:16, Twayne wrote:
>>>> On 2013-07-31 3:07 PM, Jerry Stuckle wrote:
>>>>> On 7/31/2013 2:20 PM, Twayne wrote:
>>>>>> Hi all,
...

>
> How much PHP code have you seen here recently?   How much *correct& PHP
> code has been posted by TNP?

I've seen quite a bit of code posted "here" recently, and a lot of 
helpful information.

>
> I've posted a lot of code in the past.   Unfortunately, due to trolls
> like TNP, this newsgroup has pretty much died so there is little reason
> to post any code.

What you did in the past is irrelevant when it's too far past. It's more 
important what you do NOW.  As for TNP, what he does is his business; it 
doesn't take long to identify someone who's an actual troll from one 
who's simply run across you before.

>
> Fortunately, there are a few web forums which still have good PHP
> discussions.

Name three.

Well, perhaps forums is where you should take your exaggerated ego and 
get out of here then. You're certainly not much use here if all you want 
to do is control people and use your own "Power Grabs" to make others 
feel less superior to you. If you don't want to help anyone, then don't 
respond to them; it's that simple. You seem to want to be 'part of the 
problem', not part of the solution.

I've also noticed your penchant for starting up flames and egging them 
on; I don't participate in that more than once or twice, in case you can 
redeem yourself. After a fair chance, once I decide not to read or 
respond to any of your posts, I don't.

>

[toc] | [prev] | [next] | [standalone]

#10405

On 8/4/2013 11:57 AM, Twayne wrote:
> On 2013-08-02 7:56 PM, Jerry Stuckle wrote:
>> On 8/2/2013 7:42 PM, Twayne wrote:
>>> On 2013-08-01 7:40 PM, The Natural Philosopher wrote:
>>>> On 01/08/13 22:16, Twayne wrote:
>>>>> On 2013-07-31 3:07 PM, Jerry Stuckle wrote:
>>>>>> On 7/31/2013 2:20 PM, Twayne wrote:
>>>>>>> Hi all,
> ...
>
>>
>> How much PHP code have you seen here recently?   How much *correct& PHP
>> code has been posted by TNP?
>
> I've seen quite a bit of code posted "here" recently, and a lot of
> helpful information.
>

By TNP?  You can't read very well then.

>>
>> I've posted a lot of code in the past.   Unfortunately, due to trolls
>> like TNP, this newsgroup has pretty much died so there is little reason
>> to post any code.
>
> What you did in the past is irrelevant when it's too far past. It's more
> important what you do NOW.  As for TNP, what he does is his business; it
> doesn't take long to identify someone who's an actual troll from one
> who's simply run across you before.
>

It is entirely relevant.  I post *GOOD* code when it's appropriate.  It 
wasn't necessary here, for instance, so I didn't.

>>
>> Fortunately, there are a few web forums which still have good PHP
>> discussions.
>
> Name three.

Find them yourself.  I'm not going to contribute to them being ruined by 
you and TNP like this newsgroup has been.

>  ro
> Well, perhaps forums is where you should take your exaggerated ego and
> get out of here then. You're certainly not much use here if all you want
> to do is control people and use your own "Power Grabs" to make others
> feel less superior to you. If you don't want to help anyone, then don't
> respond to them; it's that simple. You seem to want to be 'part of the
> problem', not part of the solution.
>

I have an exaggerated ego?  ROFLMAO!  I'm not trying to "control" 
anyone; neither am I trying to make "power grabs".  I just don't give a 
damn what trolls like you and TNP think about me.  You're not worth it.

And I didn't post any code in this thread because none was necessary. 
But I did give you hints on how it could be done in HTML - no PHP code 
necessary.  However, I know you aren't too smart - but this IS a PHP 
group - not an HTML group.  If you want details on how it can be done in 
HTML, then I suggest you try an HTML group.

And no, I won't post hacking code in this or any other public forum.

> I've also noticed your penchant for starting up flames and egging them
> on; I don't participate in that more than once or twice, in case you can
> redeem yourself. After a fair chance, once I decide not to read or
> respond to any of your posts, I don't.
>
>>
>

I start flames?  ROFLMAO again!

But don't worry.  You won't get any more help from me - EVER.  Try to 
get your answers from TNP.  Anonymous trolls are good at providing 
advice.  Too bad it isn't good advice - especially in his case.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#10415

On 2013-08-04 10:06 PM, Jerry Stuckle wrote:
> On 8/4/2013 11:57 AM, Twayne wrote:
>> On 2013-08-02 7:56 PM, Jerry Stuckle wrote:


>>> How much PHP code have you seen here recently?   How much *correct& PHP
>>> code has been posted by TNP?
>>
>> I've seen quite a bit of code posted "here" recently, and a lot of
>> helpful information.

You asked two questions; I answered the first and that's what you 
quoted; it's pretty obvious you're upset and cross-answering things; a 
portroyal of your ego problem.
>>
>
> By TNP?  You can't read very well then.

Did I SAY TNP? What no reading comprehension either, op top of your 
total lack of interpersonal skills?
>
...
>>
>> What you did in the past is irrelevant when it's too far past. It's more
>> important what you do NOW.  As for TNP, what he does is his business; it
>> doesn't take long to identify someone who's an actual troll from one
>> who's simply run across you before.
>>
>
> It is entirely relevant.  I post *GOOD* code when it's appropriate.  It
> wasn't necessary here, for instance, so I didn't.

No, you don't. Your ego gets in your way.
>
>>>
>>> Fortunately, there are a few web forums which still have good PHP
>>> discussions.
>>
>> Name three.
>
> Find them yourself.  I'm not going to contribute to them being ruined by
> you and TNP like this newsgroup has been.

I have them; You obviously use your trolling simply to try to irritate 
people; it doesn't work in most cases.  Get help soon.
>
...
> I have an exaggerated ego?  ROFLMAO!  I'm not trying to "control"
> anyone; neither am I trying to make "power grabs".  I just don't give a
> damn what trolls like you and TNP think about me.  You're not worth it.

Yeah, as you troll merrily along, huh?  If that has you "ROFLMAO" then 
your problems are even more obvious. I think you're pissed and and 
responding that way too.

>
> And I didn't post any code in this thread because none was necessary.
> But I did give you hints on how it could be done in HTML - no PHP code
> necessary.  However, I know you aren't too smart - but this IS a PHP
> group - not an HTML group.  If you want details on how it can be done in
> HTML, then I suggest you try an HTML group.

Didn't you already say that?  Prone to repeating yourself?
>
> And no, I won't post hacking code in this or any other public forum.

Who asked you to?
    Go ahead, show us where you mis-interpreted something again.
>
>> I've also noticed your penchant for starting up flames and egging them
>> on; I don't participate in that more than once or twice, in case you can
>> redeem yourself. After a fair chance, once I decide not to read or
>> respond to any of your posts, I don't.
>>
>>>
>>
>
> I start flames?  ROFLMAO again!

Wow, psychotic to boot?  I wonder ...
>
> But don't worry.  You won't get any more help from me - EVER.  Try to
> get your answers from TNP.  Anonymous trolls are good at providing
> advice.  Too bad it isn't good advice - especially in his case.

You're great at labeling people; perhaps you need more time to think 
about yourself ...
>

[toc] | [prev] | [next] | [standalone]

#10416

On 8/5/2013 11:17 AM, Twayne wrote:
> On 2013-08-04 10:06 PM, Jerry Stuckle wrote:
>> On 8/4/2013 11:57 AM, Twayne wrote:
>>> On 2013-08-02 7:56 PM, Jerry Stuckle wrote:
>
>
>>>> How much PHP code have you seen here recently?   How much *correct& PHP
>>>> code has been posted by TNP?
>>>
>>> I've seen quite a bit of code posted "here" recently, and a lot of
>>> helpful information.
>
> You asked two questions; I answered the first and that's what you
> quoted; it's pretty obvious you're upset and cross-answering things; a
> portroyal of your ego problem.

Yup, and you conveniently ignored the second question, like trolls do. 
Then jump on me because YOU didn't answer it.
>>>
>>
>> By TNP?  You can't read very well then.
>
> Did I SAY TNP? What no reading comprehension either, op top of your
> total lack of interpersonal skills?

No, I asked a question.  Hint: that's what the "?" is about.  But I also 
know that questions like that are beyond your limited capacity to 
understand.

>>
> ...
>>>
>>> What you did in the past is irrelevant when it's too far past. It's more
>>> important what you do NOW.  As for TNP, what he does is his business; it
>>> doesn't take long to identify someone who's an actual troll from one
>>> who's simply run across you before.
>>>
>>
>> It is entirely relevant.  I post *GOOD* code when it's appropriate.  It
>> wasn't necessary here, for instance, so I didn't.
>
> No, you don't. Your ego gets in your way.

I beg your pardon.  I DO post code when it is relevant.  I hate to 
disillusion you, but NOTHING in what you asked required ANY code.

And then you asked for code on how to hack a site - which I will NOT 
post in a public forum.  Maybe this is your way to try to get some 
sucker to tell you how to hack a site.  I won't do that - for you, or 
anyone else.

>>
>>>>
>>>> Fortunately, there are a few web forums which still have good PHP
>>>> discussions.
>>>
>>> Name three.
>>
>> Find them yourself.  I'm not going to contribute to them being ruined by
>> you and TNP like this newsgroup has been.
>
> I have them; You obviously use your trolling simply to try to irritate
> people; it doesn't work in most cases.  Get help soon.

Good.  Glad you learned to use Google.  And no, unlike you, I don't 
troll.  And I don't try to irritate people.  But your misplaced ego 
needs that.

Me, I'm quite comfortable with myself and don't need to troll to build 
my ego.  But blaming others for your problems is another symptom of 
psychiatric problems.  You really should get some help.

>>
> ...
>> I have an exaggerated ego?  ROFLMAO!  I'm not trying to "control"
>> anyone; neither am I trying to make "power grabs".  I just don't give a
>> damn what trolls like you and TNP think about me.  You're not worth it.
>
> Yeah, as you troll merrily along, huh?  If that has you "ROFLMAO" then
> your problems are even more obvious. I think you're pissed and and
> responding that way too.

Nope, I mean it as I said it.  I'm not pissed.  You're not worth it. 
But I also know that knowing you won't get me pissed pissed YOU off - so 
you have to start with the ad hominem attacks, like all trolls do.

>
>>
>> And I didn't post any code in this thread because none was necessary.
>> But I did give you hints on how it could be done in HTML - no PHP code
>> necessary.  However, I know you aren't too smart - but this IS a PHP
>> group - not an HTML group.  If you want details on how it can be done in
>> HTML, then I suggest you try an HTML group.
>
> Didn't you already say that?  Prone to repeating yourself?

Only when you obviously don't get it the first time.

>>
>> And no, I won't post hacking code in this or any other public forum.
>
> Who asked you to?
>     Go ahead, show us where you mis-interpreted something again.

You did - and I quote:

Me:

 >> I can easily build a page which has invalid information and submit
 >> it to your site.  Or even use tools like cURL to feed your site
 >> invalid information.

You:

 > Care to share the "how" of doing that, or better yet some code? This 
 > particular form isn't "live" yet or I'd put it somewhere and let you 
 > at it if I didn't have orders to the contrary from on-high

Or don't you remember what you said a 4 days ago?

>>> I've also noticed your penchant for starting up flames and egging them
>>> on; I don't participate in that more than once or twice, in case you can
>>> redeem yourself. After a fair chance, once I decide not to read or
>>> respond to any of your posts, I don't.
>>>
>>>>
>>>
>>
>> I start flames?  ROFLMAO again!
>
> Wow, psychotic to boot?  I wonder ...

Nope, laughing uproariously at your problems.

>>
>> But don't worry.  You won't get any more help from me - EVER.  Try to
>> get your answers from TNP.  Anonymous trolls are good at providing
>> advice.  Too bad it isn't good advice - especially in his case.
>
> You're great at labeling people; perhaps you need more time to think
> about yourself ...
>>
>

You should take your own advice.  After all, you started the ad hominem 
attacks.  But then trolls always try to put the blame on someone else.


-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#10334

On 8/1/2013 5:16 PM, Twayne wrote:
> On 2013-07-31 3:07 PM, Jerry Stuckle wrote:
>> On 7/31/2013 2:20 PM, Twayne wrote:
>>> Hi all,
>>>
>>> I was wondering what the general consensus might be on this:
>>>
>>> Should one Validate Radio Buttons for an online website contact form?
>>>
> ...
>
>>
>> Good practice means you ALWAYS validate ALL information from the user.
>> You may have a radio button on your form - but there is no guarantee the
>> request comes on from your form.
>>
>> I can easily build a page which has invalid information and submit it to
>> your site.  Or even use tools like cURL to feed your site invalid
>> information.
>>
>
> Care to share the "how" of doing that, or better yet some code? This
> particular form isn't "live" yet or I'd put it somewhere and let you at
> it if I didn't have orders to the contrary from on-high :)
>     I've done my best but it's obviously not enough or my questions
> wouldn't exist.
>
> Regards,
>
> Twayne`

No problem at all.  I just build a page on my site (or locally if I have 
a web server installed) and have the form's action= point at the script 
on your site.  I can place anything I want on the page and it will be 
sent to your script.

There is nothing which requires input to your site to come from a form 
on your site.  It can come from anywhere - something hackers use to 
their advantage.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#10337

Jerry Stuckle wrote:

> On 8/1/2013 5:16 PM, Twayne wrote:
>> On 2013-07-31 3:07 PM, Jerry Stuckle wrote:
>>> On 7/31/2013 2:20 PM, Twayne wrote:
>>>> Hi all,
>>>>
>>>> I was wondering what the general consensus might be on this:
>>>>
>>>> Should one Validate Radio Buttons for an online website contact form?
>>>>
>> ...
>>
>>>
>>> Good practice means you ALWAYS validate ALL information from the user.
>>> You may have a radio button on your form - but there is no guarantee the
>>> request comes on from your form.
>>>
>>> I can easily build a page which has invalid information and submit it to
>>> your site.  Or even use tools like cURL to feed your site invalid
>>> information.
>>>
>>
>> Care to share the "how" of doing that, or better yet some code? This
>> particular form isn't "live" yet or I'd put it somewhere and let you at
>> it if I didn't have orders to the contrary from on-high :)
>>     I've done my best but it's obviously not enough or my questions
>> wouldn't exist.

To better understand potential exploits, you may start with RFC 2616,
the specification of HTTP/1.1[1].  Then you may go along doing some
simple telnet sessions, e.g.

  $ telnet example.com 80
  Trying 93.184.216.119...
  Connected to example.com.
  Escape character is '^]'.
  GET / HTTP/1.1
  Host: example.com

  HTTP/1.1 200 OK
  [...]

You may augment your understanding of the HTTP protocol by inspecting
the HTTP headers that are actually sent and received by a browser (for
instance, Firefox has Tools->Live HTTP headers).  You may reconstruct
some requests done from the browser with telnet, where you may change
some of the header fields, watching the results.  A trivial example:
create a file test.php and put it in the web root of your localhost:

  <?php

  echo $_SERVER['HTTP_HOST'];

Then do:

  $ telnet localhost 80
  Trying 127.0.0.1...
  Connected to localhost.
  Escape character is '^]'.
  GET /test.php HTTP/1.1
  Host: surprise

  HTTP/1.1 200 OK
  Date: Fri, 02 Aug 2013 01:13:23 GMT
  Server: Apache/2.4.3 (Win32) OpenSSL/1.0.1c PHP/5.4.7
  X-Powered-By: PHP/5.4.7
  Content-Length: 8
  Content-Type: text/html

  surprise

Finally you may simplify and automate such requests by using cURL[2] or
the PHP cURL extension[3], for example.

> No problem at all.  I just build a page on my site (or locally if I have
> a web server installed) and have the form's action= point at the script
> on your site.  I can place anything I want on the page and it will be
> sent to your script.
> 
> There is nothing which requires input to your site to come from a form
> on your site.  It can come from anywhere - something hackers use to
> their advantage.

As Twayne is checking the referrer, you'd have to spoof that too.  Of
course that is no big deal either, but it should be noted.

[1] <http://tools.ietf.org/html/rfc2616>
[2] <http://curl.haxx.se/>
[3] <http://php.net/manual/en/book.curl.php>

-- 
Christoph M. Becker

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | comp.lang.php

csiph-web