doubledee Posted March 17, 2012 Share Posted March 17, 2012 Is it insecure to auto-populate fields on re-set forms? This pertains to two Forms on my site... Change Your Password E-mail: Password: New Password: Confirm Password: If I pre-populated E-mail above, would that be a security risk? Change Your E-mail E-mail: New E-mail: Confirm New E-mail: Password: If I pre-populated E-mail above, would that be a security risk? Thanks, Debbie Quote Link to comment Share on other sites More sharing options...
darkfreaks Posted March 17, 2012 Share Posted March 17, 2012 just make sure your auto fill is properly Sanitized beforehand and safe from injection and cross site scripting attempts. Quote Link to comment Share on other sites More sharing options...
scootstah Posted March 17, 2012 Share Posted March 17, 2012 How could that possibly be a security risk? You are returning exactly what they typed. Quote Link to comment Share on other sites More sharing options...
doubledee Posted March 17, 2012 Author Share Posted March 17, 2012 How could that possibly be a security risk? You are returning exactly what they typed. The never typed in their e-mail... That is the point... Debbie Quote Link to comment Share on other sites More sharing options...
doubledee Posted March 17, 2012 Author Share Posted March 17, 2012 just make sure your auto fill is properly Sanitized beforehand and safe from injection and cross site scripting attempts. How do I do that? When the form is loaded I look for their "memberID" in the Session and then I query the database for their record, and if it is found I display it like this... <!-- Current Email --> <label for="currEmail">E-mail:</label> <input id="currEmail" name="currEmail" type="text" maxlength="80" value="<?php if(isset($currEmail)){echo htmlspecialchars($currEmail, ENT_QUOTES);} ?>" /><!-- Sticky Field --> <?php if (!empty($errors['currEmail'])){ echo '<span class="error">' . $errors['currEmail'] . '</span>'; } ?> Debbie Quote Link to comment Share on other sites More sharing options...
kicken Posted March 17, 2012 Share Posted March 17, 2012 The never typed in their e-mail... That is the point... Maybe not on that page, but they did at somepoint, otherwise how would you know what to fill in? So long as your not setting it up so it will pre-fill based on an ID number in the URL or something like that, there is no problem from a data-leak point of view. The user should only be able to see whatever is on record for their account. How do I do that? The same way we've told you in the past, you run any user-inputted data through htmlentities() before you display it on the page. Your code shows you doing that so your fine. Quote Link to comment Share on other sites More sharing options...
doubledee Posted March 17, 2012 Author Share Posted March 17, 2012 The never typed in their e-mail... That is the point... Maybe not on that page, but they did at somepoint, otherwise how would you know what to fill in? So long as your not setting it up so it will pre-fill based on an ID number in the URL or something like that, there is no problem from a data-leak point of view. The user should only be able to see whatever is on record for their account. How do I do that? The same way we've told you in the past, you run any user-inputted data through htmlentities() before you display it on the page. Your code shows you doing that so your fine. Okay, thanks! Debbie Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.