[SOLVED] Question about Form Filtering

[bill bratske]

I'm working on filtering form data according to the PHP Consurtiom's http://phpsec.org/projects/guide/1.html#1.2 recommendations, and I had a question about it.

 

Is it good form to do the form filtering this way?:

 

//Filter form data
switch ($_POST['form'])
{
    case 'thisform':
        $allowed = array();
        $allowed[] = 'form';
$allowed[] = 'x';
$allowed[] = 'y';

        $sent = array_keys($_POST);

        if ($allowed != $sent)
        {
//reditect away
		header("location:login-failure.php");
		exit();
}
break;
} //end switch

//Rest of code that processes data including..
$x = $_POST['x'];
$y = $_POST['y'];

 

The reason I ask is because I was doing it this way, and then it occurred to me that maybe the form could still be spoofed using the same form that just didn't include the value 'thisform' in the hidden 'form' input field...

 

What I mean is, if the form didn't include 'thisform' and never made the criteria for the case statement to process it, would the page just accept the fake form because the rest of the page processes anyways?

 

Thanks.

 

[bill bratske]

OK I'm an idiot .  I was right that it will process a fake form, I don't know why I didn't just set up a test before I posted... 

Im trying to mark this sovled but I cant figure out how... lol