How do I keep users from spoofing data through a form?
- by Jonathan
I have a site which has been running for some time now that uses a great deal of user input to build the site. Naturally there are dozens of forms on the site. When building the site, I often used hidden form fields to pass data back to the server so that I know which record to update.
an example might be:
<input type="hidden" name="id" value="132" />
<input type="text" name="total_price" value="15.02" />
When the form is submitted, these values get passed to the server and I update the records based on the data passed (i.e. the price of record 132 would get changed to 15.02).
I recently found out that you can change the attributes and values via something as simple as firebug. So...I open firebug and change the id value to "155" and the price value to "0.00" and then submit the form. Viola! I view product number 155 on the site and it now says that it's $0.00. This concerns me.
How can I know which record to update without either a query string (easily modified) or a hidden input element passing the id to the server?
And if there's no better way (I've seen literally thousands of websites that pass the data this way), then how would I make it so that if a user changes these values, the data on the server side is not executed (or something similar to solve the issue)?
I've thought about encrypting the id and then decrypting it on the other side, but that still doesn't protect me from someone changing it and just happening to get something that matches another id in the database.
I've also thought about cookies, but I've heard that those can be manipulated as well.
Any ideas? This seems like a HUGE security risk to me.
