HTML 选择列表验证
我正在开发一个网络应用程序项目（在java中；这并不重要），我们有一个带有下拉列表和输入字段的表单。
显然，提供下拉列表是因为我们期望从一组值中获得特定值。
所以我的问题是：确保提交的值位于预期值集中是否有意义？ 或者仅仅假设遇到正确的值是否可以接受？
提交不同的值不会产生任何“错误”， 但数据存储与业务规则/要求不一致。
I'm working on a web app project (in java; not that it matters) and we have a form with drop down lists and input fields.
Obviously drop down lists are provided because we expect a specific value from a set of values.
So my question is this: does it make sense to ensure the submitted value is in the set of expected values? Or is it acceptable to just assume the correct value is coming across?
There aren't any "errors" that would arise from different values being submitted,
but the data store would not be consistent with the business rules/requirements.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
最佳实践：假设每个用户都是一个肮脏的黑客，他们会为您服务，并会尽其所能地让您的网站瘫痪。
因此，所有数据都必须在服务器端进行验证。
黑客不会使用您的表单。 他们创建随机表单数据并通过其他方式提交。
事实上，黑客甚至不知道您的网站做了什么——他们的扫描仪只是在您的网站上徘徊并提交随机内容。
我使用广泛的客户端验证（c# 验证器）并验证表单上的每个字段。 这样，当用户使用我的表单时，当最终到达服务器时，数据应该是好的。
但是，我们仍然得到不好的数据！ 这是黑客使用他们自己的工具探测该网站。
我们并不是一个好的目标——我们没有任何暴露在网络上的财务记录，那又怎样呢？ 如果您可以免费使用我们的网站。 问题是黑客不知道这一点，并且仍在进行探索。
Best Practice: Assume that every user is a dirty hacker who has it in for you and will do everything in their power to bring your site down.
Therefore, it is imperative that all data be validated server side.
Hackers don't use your form. They create random form data and submit it via other means.
In fact, the hacker doesn't even know what your site does -- Their scanner just wandered across your site and is submitting random stuff.
I use extensive client side validation (c# validators) and validate every field on my forms. That way when a user uses my forms, when the finally hit the server, the data should be good.
But, we still get bad data! It's hacker's probing the site using their own tools.
It's not like we're a good target -- we don't have any financial records exposed to the net and so what? if you get to use our site for free. The issue is that the hackers don't know that, and are probing anyways.
您绝对应该验证提交的值是否在预期值集中。 使用 firebug 提交您想要的下拉列表的任何内容是微不足道的。
You definitely should validate that the submitted value is in the set of expected values. It's trivial to use firebug to submit whatever you want for a dropdown.