Lately very interested in securing my PHP scripts. A question how can you secure that the data send to a PHP script come from your PHP form and not from a form somebody else created? Is there a way to get the domain in which the form is uploaded so to check that it is in my domain or something like that?
-
-
Not really no.
Your <form> has actually nothing to do with PHP. It's purely HTML, instructing the client's browser what sort of data your PHP code expects to receive.
Whether the browser is ultimately responsible for sending the request, or if the request is created by some other means, you can't really know.
Requests created by a browser can easily be duplicated and manipulated.
The best thing to do is just make sure that the data you are receiving is valid; making sure numbers are numbers, emails are emails, links are links, and so forth.
The Variable handling Functions and Regular Expressions are very helpful there. -
Adding to Atli's post: there's no real advantage to securing where the data comes from. You should just be safe knowing that you're back-end processing of the data is keeping anything malicious out. That is, I assume you are sanatising it? ;)
Oh, I could've sworn that bottom section wasn't there when I went to post my answer! LOL! I'm losing it.Comment
Comment