Posted by Toby A Inkster on 01/24/08 13:24

Shelly wrote:

> Why is this the problem?
>
> <input type="hidden" value="<?php echo $securityCode; ?>"
> name="securityHidden">

The problem is twofold:

1. The security code might be in a hidden field, but the field can still
be seen quite easily by viewing the source code to the page.

2. An even bigger problem: the client can change the contents of the
securityHidden field -- change it to "" for instance.

--
Toby A Inkster BSc (Hons) ARCS
[Geek of HTML/SQL/Perl/PHP/Python/Apache/Linux]
[OS: Linux 2.6.17.14-mm-desktop-9mdvsmp, up 25 days, 33 min.]

CSS to HTML Compiler
http://tobyinkster.co.uk/blog/2008/01/22/css-compile/

• Next in forum: Re: how to get all the version numbers - apache, mysql, php, modules etc.
• Prev in forum: Re: How to make URL cloaking
• Thread view: Re: Contact Form Spam

[Reply to this message]