brent123456 Posted October 11, 2007 Share Posted October 11, 2007 I am having my site tested for security and one of the problems was being able to edit the drop down boxes with arbitray values I was wondering if someone could help me understand how to prevent this. Thanks. Quote Link to comment Share on other sites More sharing options...
micah1701 Posted October 11, 2007 Share Posted October 11, 2007 perhaps you could show the code or at least better explain the problem. Quote Link to comment Share on other sites More sharing options...
marcus Posted October 11, 2007 Share Posted October 11, 2007 When posting the form check to see if the value of the selection is one of the valid ones. So if you're using a SQL query: $sel = $_POST['sel']; if($sel){ $sql = "SELECT * FROM `table` WHERE `this`='$sel'"; $res = mysql_query($sql) or die(mysql_error()); if(mysql_num_rows($res) == 0){ echo "Doesn't exist"; }else { echo "Exists"; } } Quote Link to comment Share on other sites More sharing options...
brent123456 Posted October 11, 2007 Author Share Posted October 11, 2007 That is excellent advice. Thank you. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.