PHP Security-Cheat form submission

Cheat form Submission

Making a cheat sheet is almost as simple as faking a URL. After all, the submission of the form is just an HTTP request from the browser. The partial format of the request depends on the form, and the data in some requests comes from the user.

Most tables specify the Action property with a relative URL address:

  <form action= "process.php" method= "POST" >

When the form is submitted, the browser requests the URL specified in the action, and it uses the current URL address to locate the relative URL. For example, if the previous form was the result of a response to a http://www.php.cn/request, the URL address http://www.php.cn/is requested after the user submits the form.

Knowing this, it's easy to think that you can specify an absolute address so that the form can be placed anywhere:

<formaction= "http://example.org/path/to/process.php" method= "POST" >

This form can be placed anywhere, and the submission generated by using this form is the same as the submission generated by the original form. Aware of this, an attacker could change the action to an absolute URL address by viewing the page source file and saving it on his server. By using these means, an attacker could arbitrarily change the form, such as canceling the maximum field length limit, canceling the local validation code, changing the value of the hidden field, or overwriting the element type for more flexible purposes. These changes help the attacker to submit any data to the server, and because the process is simple, the attacker does not need to be an expert.

Spoofing a form attack is not preventable, although it may seem a bit strange, but in fact it does. But you don't have to worry about that. Once you have filtered the input correctly, the user must obey your rules, which is irrelevant to how they are submitted.

If you experiment with this technique, you may notice that most browsers include a referer message in the HTTP header to identify the address of the previous page. In this example, the value of Referer is the URL address of the form. Don't be fooled by it to differentiate your form submissions or cheat form submissions. In the next section of the demo, you can see that the HTTP header is also very easy to fake, and the way to judge using Referer is well known.

The above is the PHP security-cheat form submission content, more relevant content please pay attention to topic.alibabacloud.com (www.php.cn)!

