在提交表单之前修改 html：防止这种黑客攻击
我意识到恶意用户可以在提交表单之前在浏览器中修改表单的 html。 例如，交换两个相同类型的输入字段的名称。
我正在创建一个网站，该网站很大程度上依赖于数据库中每个条目之间的关系。
如果发生这种情况，可能会危及我网站的所有功能。 （我已经测试过它，它确实切换了用户（即我）在浏览器中切换名称的两个字段的输入。
我们如何才能防止这种情况发生？
I came to a realization that malicious users can modify the html of a form in their browser before submitting a form.
For example, switching the names of two input fields of the same types.
I am creating a website that's largely dependent upon relationships between each entries in the database.
If this happens, it could jeopardize all functions of my sites. (I've tested it, and it does switched the inputs from the two fields who names are switched in the browser by the user, ie. me)
How could we prevent this?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
如果这种黑客行为导致服务器端出现问题，您无法在浏览器代码中修复它。这意味着您需要在服务器上修复此问题。
任何人都可以生成任何类型的 POST 或 GET 到您的服务器，您需要为此做好准备。
因此，请确保在服务器上检测到这种篡改，并通过返回错误消息或默默地忽略此类无效请求来进行处理。
如果服务器为此做好了准备，您就可以让人们在浏览器中随心所欲地进行黑客攻击。
If this kind of hack causes problem on the server side, you cannot fix it in your browser code. It means that you need to fix this on the server.
Anyone can generate any kind of POST or GET to your server, and you need to be prepared for that.
So, make sure that you detect this kind of tampering on the server, and deal with it there, by returning an error message, or by silently ignoring such invalid requests.
If the server is prepared for this, you can let people hack away in their browser as much as they want.
您应该按照 PHP 验证手册 中的说明验证您的输入。例如，我们有一个帖子的表单输入
title和body。当用户提交帖子时，title应介于 1 到 40 个字符之间，因此我们应该通过 PHP 进行验证。其次，body不应包含恶意文本或代码，因此我们应该使用addslahes()等函数对其进行清理。整个主题围绕 PHP 安全性展开。防止黑客攻击和恶意意图的唯一方法是学习安全知识。通过上面的链接开始学习。
You should be validating your inputs as seen on the PHP Manual for Validation. For example, we have form inputs
titleandbodyfor a post. When the user submits the post, thetitleshould be between 1 to 40 characters, so we should validate that through PHP. Second, thebodyshould not contain malicious text or code, so we should sanitize that with a function such asaddslahes().The entire topic revolves around PHP security. The only way to prevent hacking attempts and malicious intent is to learn security. Start learning with the link above.
据我所知，最简单且通常最好的解决方案是在将查询发送到数据库之前检查每个输入字段是否具有 php 的有效值。例如，名称为“电话”的字段只能是数字，并且长度不能超过 10 个密码。把规则制定得足够严格，就不会有任何问题。此外，您还应该确保您的数据库字段是严格的，即。只允许您想要的长度和数据类型。
As far as I know the simplest and often best solution is to check if each input field has a valid value with php before sending the query to the DB. For example, a field with the name "telephone" should only be numeric and not longer then say 10 ciphers. Make the rules strict enough and you shouldn't have any problems. In addition you should also make sure your DB fields are strict ie. only allow the length and data type you want.