Member Avatar for klemme

Hi all,

I am creating an ecommerce site, and have some javascript getting data from dom elements and inserting them into my PHP Cart via AJAX.

It all works fine, but then i came to think of possible security issues with my approach.

Button inserting data into the cart with js, looks pretty much like this.

<p data-prodid="30" data-price="700">Add product To Cart</p>

I validate that the product exists serverside, so its not possible to add products that doesnt exists (by ID).

But I opened Chrome dev tools (F12) - And simply changed data-prodid="30", to data-prodid="1". That change were passed through to my PHP script (where i do all nessecary validation), but I was able to change to product to be added to the cart, simply by changing a DOM attributte.

I get the price for the product serverside, by looking up on the prodID. So the price cant be changed..

Is it really that easy to manipulate a live site, just by changing whatever attributtes used?

Im still on localhost, developing - But came to think of this approach and use of data-attributtes in this fashion was a good idea at all.

Can anyone share some thoughts on this approach? (Using HTML5 data attributtes for cart functionality).

If my setup was different, say i didnt get the price from the prodID passed, but also directly from the html5 data-attributte - Would that allow hackers to change cart totals in such an easy way?

Is there any way, I can detect of these attributtes has been manipulated or entirely prevent this?

The best, Klemme

Edited by klemme
  • 2 Contributors
  • 1 Reply
  • 248 Views
  • 3 Hours Discussion Span
  • Latest Post Latest Post by pritaeas
Member Avatar for pritaeas

Is it really that easy to manipulate a live site, just by changing whatever attributtes used?

Basically. If you don't think ahead, you might forget this can happen. I've seen such things in production code.

Can anyone share some thoughts on this approach?

If you just use the ID, then changing it doesn't really matter. Assuming you check server side if it's still in stock etc. If you use details that will be used on the order, please don't.

If my setup was different, say i didnt get the price from the prodID passed, but also directly from the html5 data-attributte - Would that allow hackers to change cart totals in such an easy way?

Yes. Some basic Javascript knowledge suffices for this. Any kid can do this.

Is there any way, I can detect of these attributtes has been manipulated or entirely prevent this?

Store a hash/token alongside that can be used to verify manual change.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.