Re: Php login/registration page

From	Denis McMahon <denismfmcmahon@gmail.com>
Newsgroups	comp.lang.php
Subject	Re: Php login/registration page
Date	2014-10-03 03:29 +0000
Organization	A noiseless patient Spider
Message-ID	<m0l577$4et$2@dont-email.me> (permalink)
References	<844d52dc-57de-48bc-8d61-ef12d7696389@googlegroups.com> <m0fjdl$64d$1@dont-email.me> <ECKWv.296304$Q61.224596@fx13.iad> <m0gr5h$b0m$1@dont-email.me> <XnsA3BB1AEBFA590R2D2@127.0.0.1>

Show all headers | View raw

On Fri, 03 Oct 2014 01:38:44 +0000, GS wrote:

> Actually you can do it with hidden fields, effectively turning a form
> into a giant cookie.

You only need one [hidden] field to pass as much data as you like, as you 
can put all the data you want to pass in a serialised string form eg json.

However there are flaws:

You're exposing almost all the data to the user, including any hashes 
used to verify the data is unchanged. This may present various attack 
vectors.

If this is a get request, you'll hit a request string length limit fairly 
quickly. This may limit the usefulness of the method.

To be honest, the exercise as set is an extremely bad one, as it is 
forcing the students to use fundamentally unsafe methods. It would be 
better to teach the building blocks of good secure form handling first, 
and then give them exercises in form handling to complete.

It seems that the lecturer has fallen into the mistake of starting the 
hands on coding before teaching the important fundamentals. A course 
designed around coding websites with PHP should commence with in depth 
explanations and examples of preventing security flaws, validating and 
verifying input, and the mechanisms PHP provides to prevent the users 
messing with the data, rather than exercises that teach coders to hand 
all the data to the user to play with!

-- 
Denis McMahon, denismfmcmahon@gmail.com

Thread

Php login/registration page Apple Sizat <afor6993@gmail.com> - 2014-09-30 16:04 -0700
  Re: Php login/registration page Jerry Stuckle <jstucklex@attglobal.net> - 2014-09-30 20:55 -0400
    Re: Php login/registration page Richard Damon <Richard@Damon-Family.org> - 2014-09-30 23:33 -0400
      Re: Php login/registration page "J.O. Aho" <user@example.net> - 2014-10-01 06:51 +0200
      Re: Php login/registration page Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-01 08:13 -0400
        Re: Php login/registration page Richard Damon <Richard@Damon-Family.org> - 2014-10-01 22:37 -0400
        Re: Php login/registration page GS <nomail@nospam.org.invalid> - 2014-10-03 01:38 +0000
          Re: Php login/registration page Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-02 21:43 -0400
          Re: Php login/registration page Denis McMahon <denismfmcmahon@gmail.com> - 2014-10-03 03:29 +0000
            Re: Php login/registration page Matthew Carter <m@ahungry.com> - 2014-10-03 00:24 -0400
              Re: Php login/registration page Denis McMahon <denismfmcmahon@gmail.com> - 2014-10-03 18:33 +0000
                Re: Php login/registration page Matthew Carter <m@ahungry.com> - 2014-10-03 16:16 -0400
                Re: Php login/registration page Ed Mullen <ejEVOMER@edmullen.net> - 2014-10-03 18:24 -0500
                Re: Php login/registration page Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-03 20:37 -0400
  Re: Php login/registration page Michael Vilain <vilain@NOspamcop.net> - 2014-09-30 18:38 -0700
  Re: Php login/registration page gordonb.opkrz@burditt.org (Gordon Burditt) - 2014-09-30 21:08 -0500

csiph-web