Changing the Value of a drop down box.

[brent123456]

I am having my site tested for security and one of the problems was being able to edit the drop down boxes with arbitray values I was wondering if someone could help me understand how to prevent this.

Thanks.

[micah1701]

perhaps you could show the code or at least better explain the problem.

[marcus]

When posting the form check to see if the value of the selection is one of the valid ones.

 

So if you're using a SQL query:

 

$sel = $_POST['sel'];

if($sel){
$sql = "SELECT * FROM `table` WHERE `this`='$sel'";
$res = mysql_query($sql) or die(mysql_error());
   if(mysql_num_rows($res) == 0){
   echo "Doesn't exist";
   }else {
   echo "Exists";
   }
}

[brent123456]

That is excellent advice. Thank you.