form security

[maxelcat]

Dear ALl

I have recently made some forms using javascript (up until then I ususally did so in php).

I have some simple user validation - required fields, correct format for email etc etc When submit is pressed a simple php script operates to send the detail in an email

I have recently got concerned about the security of these forms. This mornign I recevied a form reply in which all the fields were blank. (i managed to reproduce this myself using javascript:document.spamform.onsubmit="return true;";

So now I am worried that someone can use my form to hack the site, which is a joomla cms. We have taken quite a few security precautions for the site, but not in the form

I have spent some time searching around google, and its overwhelming!!!

Could somebody please direct me as to where to start. Should I just dump the javascript form and rework it in php, adding stripslases and so on? Or are there some things I can do to avoid this form being used?

I'd really apprecaite any pointers!

Thanks in advance

Edward

[Taywin]

Maybe you should look into 2 things - SQL injection and Cross Site Scripting (XSS). These 2 are common in attacking website database/content. Then you should have more understanding about prevention.

By the way, do not use ONLY JavaScript to validate user input. The JavaScript is for convenient but not for security because user can easily manipulate with the script (and you have no protection of it). You must always do the validation on your server side.

[vhss]

Hi maxelcat! From own experience JavaScript can be cheated easily, so definitely you need to use anything else. Using two or more different strategies for verification can make really hard time for not-so-professional hackers (who are some 80%).

Good luck!

:)

[maxelcat]

HI and thanks for the replies. Since the post I have done the following - all in php

• created a check that all the right fields are arriving
• added htmlspecialchars(stripslashes(trim($_POST(....
• added regular expressions
• added a final check that none of the data contains html|htmls|ftp|www

If any of the above are failed then the php script does exit() and a cute little message about possibly dangerous script having been entered appears

Would that be enough do you think? I know you can never be 100% secure...

Thanks again

E

[pritaeas]

I found this article an interesting read. Got some good ideas from it.

[vhss]

I'm sure that should be enough (if you not selling FBI secrets over your website).

:)

[almostbob]

nothing clientside is secure,

[vhss]

Well, yes, but... Now maxelcat cut off the amateurs and professionals too busy with more serious projects like Nigeria's banks or so...

There is no absolute safety in this world.

:cool: