From michael.southwell at nyphp.com Tue May 1 11:33:48 2007 From: michael.southwell at nyphp.com (Michael Southwell) Date: Tue, 01 May 2007 11:33:48 -0400 Subject: [nycphp-talk] form spoofing Message-ID: <6.2.3.4.2.20070501113111.028cb6c0@mail.optonline.net> I thought I was following best practices ( http://www.nyphp.org/phundamentals/spoofed_submission.php ) in creating a comment form for a restaurant client (There is no security issue here; the comments are emailed): I stored a random token in the session: session_start(); if ( ! isset( $_SESSION['secret'] ) ) $_SESSION['secret'] = uniqid( rand(), TRUE ); I hid that token in the form:
// the processor if (array_key_exists('email', $_POST) && strlen($_POST['email']) == 0) { // ok } else { // spoofed } Not necessarily hard to beat, but it killed all of the automated form posts my clients were receiving. Mark > -----Original Message----- > From: talk-bounces at lists.nyphp.org > [mailto:talk-bounces at lists.nyphp.org] On Behalf Of Michael Southwell > Sent: Tuesday, May 01, 2007 11:34 AM > To: talk at lists.nyphp.org > Subject: [nycphp-talk] form spoofing > > I thought I was following best practices ( > http://www.nyphp.org/phundamentals/spoofed_submission.php ) > in creating a comment form for a restaurant client (There is > no security issue here; the comments are emailed): > > I stored a random token in the session: > > session_start(); > if ( ! isset( $_SESSION['secret'] ) ) $_SESSION['secret'] = > uniqid( rand(), TRUE ); > > I hid that token in the form: > >