当前位置：文江博客话题详情

保护表单数据免受恶意用户使用 Firebug 侵害的最佳方法？

发布于 2024-11-09 15:40:45 字数 491 浏览 4 评论 0原文

我读过几个相关问题，但他们没有直接回答我的问题。 Firebug 等开发人员工具允许任何人在发送表单之前查看和操作表单数据。一个很好的例子是调整隐藏的“成员 ID”字段的值，以便将表单提交记入另一个用户的帐户。

防止此类篡改的最佳方法是什么？我的研究建议将敏感的表单输入移至服务器端脚本，但还有其他选择或注意事项吗？

我熟悉 PHP 和 jQuery，因此我理想的解决方案将使用其中一种或两种语言。

原文

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

冷了相思 2024-11-16 15:40:45

您不能使用 jQuery 来保证安全，因为它都是在客户端处理的。

在您的示例中，只需在隐藏的输入字段中使用 PHP 会话，因为正如您正确指出的那样，这可以被操纵。

使用会话将如下所示：

登录页面

<form action="login.php" method="post">
  <input type="text" name="username">
  <input type="password" name="password">
  <input type="submit" name="submit" value="submit">
</form>

// you have to include this on every page to be able to user sessions.
// also make sure that you include it before any output
session_start();

//Always sanitize the user input before doing any db actions.

//For example by using: `mysql_real_escape_string()` ( http://php.net/manual/en/function.mysql-real-escape-string.php ).

// check user credentials against db

$_SESSION['user'] = $dbresult['username'];

page-where-userid-is-required.php

session_start();

if (!isset($_SESSION['user'])) {
    // user is not logged in!
} else {
    // use user info to place order for example
}

会话将处于活动状态，直到用户关闭浏览器/直到会话过期（这是 PHP 设置

）只是一些示例代码，可以给您一个想法。

它适用于较小的项目，但是随着项目变得更加复杂，我建议采用 MVC（模型、视图、控制器）方式。 ( http://en.wikipedia.org/wiki/ Model%E2%80%93view%E2%80%93controller ）

但这完全是另一个故事了:)

You can't use jQuery for security since it's all handled on the client side.

In your example just use a PHP session in staed of a hidden input field, because as you rightfully noted this can be manipulated.

Using sessions would look something like the following:

<form action="login.php" method="post">
  <input type="text" name="username">
  <input type="password" name="password">
  <input type="submit" name="submit" value="submit">
</form>

// you have to include this on every page to be able to user sessions.
// also make sure that you include it before any output
session_start();

//Always sanitize the user input before doing any db actions.

//For example by using: `mysql_real_escape_string()` ( http://php.net/manual/en/function.mysql-real-escape-string.php ).

// check user credentials against db

$_SESSION['user'] = $dbresult['username'];

page-where-userid-is-required.php

session_start();

if (!isset($_SESSION['user'])) {
    // user is not logged in!
} else {
    // use user info to place order for example
}

The session will be active until the user closes his browser / until the session expires (which is a PHP setting)

The above is just some sample code to give you an idea.

It works smaller projects, however as projects get more complex I would suggest going for the MVC (Model, View, Controller) way. ( http://en.wikipedia.org/wiki/Model%E2%80%93view%E2%80%93controller )

But that's just a whole other story :)

回复收藏 0 原文