Member Avatar for isomillennium

is there any way to get a form name from a page that the post or get variables sent from ?

for example : $_POST , $_POST .. What would it be if you wanted the form name to be sent ?

  • 3 Contributors
  • 4 Replies
  • 115 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by sDJh

Dani AI

Generated

Short answer: browsers do not automatically include the <form> element's name in the POST/GET payload. As observed, that metadata lives in the page DOM; as showed, client-side JavaScript can read it, but client-side values can be forged and are not a reliable server-side authentication method.

For a practical, secure check use a server-generated token tied to the user session (CSRF-style). Put a cryptographically random token in the session, render it into the form as a hidden field, and validate it on submit. Example pattern:

// generate and embed (on page render)
session_start();
if (empty($_SESSION['form_token'])) {
    $_SESSION['form_token'] = bin2hex(random_bytes(32));
}
<input type="hidden" name="form_token" value="<?php echo htmlspecialchars($_SESSION['form_token']); ?>">
// verify (on submit)
session_start();
if (!isset($_POST['form_token']) || !hash_equals($_SESSION['form_token'], $_POST['form_token'])) {
    // reject request
}
unset($_SESSION['form_token']); // prevent replay

If you need to ensure the form’s integrity (not just origin), append a timestamp and an HMAC signature of key fields and verify freshness and the signature on submit. That defends against replay and tampering when combined with a server secret.

Extra practical notes: use HTTPS, rotate or single-use tokens, enforce input validation and rate-limiting, and do not rely solely on Referer headers or obscuring field names (as suggested) — that is security by obscurity. For a concise authoritative guide on the token approach see the OWASP CSRF Prevention Cheat Sheet (https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html).

Recommended Answers

All 4 Replies

Member Avatar for sDJh

HTTP doesn't transfer any information about the form, because the website generates the code itself. I believe that the tag "name" was added with JavaScript to access these field in JS.

But what do you need it for? The only thing I can imagine is one of these phishers or cookie-grappers. If you want to know how this works you better don't ask me.

Member Avatar for isomillennium

nah i just want to make sure that these variables came from the form i have set up and not from someone who is trying to hack their way in ... just another security measurement in a login form

Member Avatar for nav33n

I am not sure if its possible in Php. But its definitely possible in javascript.

<html>
<head>
<script type="text/javascript">
function getformname(form) {
	alert(form.name);
	return false;
}
</script>
</head>
<body>
<form name="test" action="test.php" method="post" onsubmit="javascript: return getformname(this);">
<input type="submit" name="submit" value="submit">
</form>
</body>
</html>

Cheers,
Nav

Member Avatar for sDJh

then why don't you vary the names of the textfields? Eg

name="name<?echo date("Y-m-d")?>"
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.