How to prevent this html form based hack-cracking ?

[ankur0101]

Hi,

Web developers use a tool called Firebug wth mozilla.

But we can use this firebug to crack any form which connects to payment gateway.

 

Support we have

 

<form id="form1" name="form1" method="post" action="to_pay_gateway">
   <p>
     <input type="hidden" name="amount" value="10" />
   </p>
   <p>
     <input type="submit" name="button" id="button" value="Submit" />
   </p>
</form>

 

In above sample code, action is to_pay_gateway i.e. it could any any link given by payment gateway.

While running this code in browser shows just a button, after clicking that button we would go to third party payment gateway page.with $10

 

When I start firebug and see source code of page, I changed amount to 1

 

So after clicking on submit button, I went to payment page, where I have to pay $1 and not $10.

This is very dangerous for automated system portals such as bus booking, movie booking etc.

 

Is there any alternative ? How can we stop this crack-hack using PHP?

 

Thanks

 

[Pikachu2000]

That has nothing to do with Firebug, the same thing can just as easily be done with any text editor. Using hidden form fields to hold data that the user shouldn't have access to is simply bad design.

[Monkuar]

Check the amount server side with paypal.

 

 

Or simply check the minimum amount with $_POST.

 

Paypal will call a hidden URL for the transaction, that you specify.  I think it's the 'notify_url' variable.

 

Just make sure no one can donate less than "XX" amount, you'll be fine.

[PFMaBiSmAd]

The payment gateway forms that have and use the price submitted from the form are only useful for 'donations', where the visitor is the one who selected the amount in the first place.

 

For anything else, you need to set the price for each item within the payment gateway's control panel.