客户端网页编辑有问题吗？

Question

This is mostly for radio buttons but; what would happen if you edited the raw html of a web-page live in your browser and changed the value of a radio box? If you decided to send that information through a form using php would the changed value of the radio button be sent or would it simply just retrieve its original values? I would test this hypothesis but apache won't install properly.

Answer 1

You can send whatever info you like from your browser, you have complete control. So yes, you can send anything from any form - this is why client side sanity checks are useless.

Try out tamperdata (Firefox plugin) to view, and edit any POSTs your browser makes. Or you can (as you say) use firebug (another Firefox plugin) to edit the code of any site, and view it in your browser.

Answer 2

The value that the HTML page submits is what the server receives. That's why you need to validate data server side before relying on it. You should assume that every user a malicious hacker.

$acceptable_values = array('0', '1', '2');
if(in_array($_POST['radio'], $acceptable_values)) {
    //Radio button value is valid
} else {
    //Radio button is not valid
    die('Nice Try!');
}

Or you could have the radio button's value set to a default if it does not contain a valid value...

$acceptable_values = array('0', '1', '2');
if(in_array($_POST['radio'], $acceptable_values)) {
    $radio = $_POST['radio'];
} else {
    $radio = '0'; //Default
}

It's important to note that with the invention of tools like Firebug (gecko) and Inspector (webkit) you don't need to download, modify, and the view the HTML page. You can edit it live in the browser.

Answer 3

Any person can post anything to any website. That's the biggest security issue in the web. And that's why you should DOUBT, VALIDATE AND SANITIZE ANY user input data. Since PHP 5.2 if I remember correctly, you have the function filter_var($var_to_be_filter, FILTER_TO_BE_APPLIED);

With that, you can avoid 2 security issues SQL Injection and XSS (Cross Site Scripting) . Unfortunately, there are more security risks you have to consider; CSRF , Cookie Hijacking , External File Access , Remote File Inclusion , Session Fixation , Directoy traversal , etc.