Web Analytics Made Easy -
StatCounter Add security to hidden form field - CodingForum

Announcement

Collapse
No announcement yet.

Add security to hidden form field

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • Add security to hidden form field

    I am trying to create a blog which allows the owner to add a post which includes an single image upload.
    The CMS will also have an edit post option which will allow the previous image to be replaced with a new one
    (automatically deleting the previous image) or simply leave the current image unchanged.

    The old image name is retrieved from a database and stored as the value of a hidden form field $oldimage
    I would like to add security to the form so that if the hidden form field value is changed in some way the name
    submitted will no longer be an exact match of the name stored in the database and so trigger an error.

    I had a try using the if(!file_exists($oldimage)) { trigger error } however couldn't get it to work.
    Is there a standard (or better) way to do this?

    PHP Code:
    $newimage=$_FILES['upload']['name'];                        
    unlink("uploads/".$oldimage);
            
    move_uploaded_file($_FILES['upload']['tmp_name'],"uploads/".$newimage);                           
     }                                
    }else{        
    // if the image is not replaced, keep the original image details        
    $newimage=$oldimage;


  • #2
    Originally posted by maxwell5 View Post
    I am trying to create a blog which allows the owner to add a post which includes an single image upload.
    The CMS will also have an edit post option which will allow the previous image to be replaced with a new one
    (automatically deleting the previous image) or simply leave the current image unchanged.

    The old image name is retrieved from a database and stored as the value of a hidden form field $oldimage
    I would like to add security to the form so that if the hidden form field value is changed in some way the name
    submitted will no longer be an exact match of the name stored in the database and so trigger an error.

    I had a try using the if(!file_exists($oldimage)) { trigger error } however couldn't get it to work.
    Is there a standard (or better) way to do this?

    PHP Code:
    $newimage=$_FILES['upload']['name'];                        
    unlink("uploads/".$oldimage);
            
    move_uploaded_file($_FILES['upload']['tmp_name'],"uploads/".$newimage);                           
     }                                
    }else{        
    // if the image is not replaced, keep the original image details        
    $newimage=$oldimage;

    Why pass the oldimage id/name in the hidden field in the first place? Query it again when saving.
    Don't use old mysql library
    The Absolute Minimum Every Software Developer Absolutely, Positively Must Know About Unicode and Character Sets
    When a white horse is not a horse

    Comment


    • #3
      Originally posted by maxwell5 View Post
      I am trying to create a blog which allows the owner to add a post which includes an single image upload.
      The CMS will also have an edit post option which will allow the previous image to be replaced with a new one
      (automatically deleting the previous image) or simply leave the current image unchanged.

      The old image name is retrieved from a database and stored as the value of a hidden form field $oldimage
      I would like to add security to the form so that if the hidden form field value is changed in some way the name
      submitted will no longer be an exact match of the name stored in the database and so trigger an error.

      I had a try using the if(!file_exists($oldimage)) { trigger error } however couldn't get it to work.
      Is there a standard (or better) way to do this?

      PHP Code:
      $newimage=$_FILES['upload']['name'];                        
      unlink("uploads/".$oldimage);
              
      move_uploaded_file($_FILES['upload']['tmp_name'],"uploads/".$newimage);                           
       }                                
      }else{        
      // if the image is not replaced, keep the original image details        
      $newimage=$oldimage;

      Why pass the oldimage id/name in the hidden field in the first place? Query it again when saving.
      file_exists is a good function if you know what you are checking. Checking if a random string passed from the user exists is an extra security vulnerability.
      Don't use old mysql library
      The Absolute Minimum Every Software Developer Absolutely, Positively Must Know About Unicode and Character Sets
      When a white horse is not a horse

      Comment


      • #4
        If there is only one image per user that will always be overwritten by a new image then just hard code a default image name in the code along with the username in the path. You will need to ensure proper permissions for the code to create the username directory's with read/write permissions.

        PHP Code:
        move_uploaded_file($_FILES["file"]["tmp_name"], "../upload/$username/" defaultfilename.jpg); 
        To save time, lets just assume I am almost never wrong.

        The XY Problem
        The XY problem is asking about your attempted solution (X) rather than your actual problem (Y). This leads to enormous amounts of wasted time and energy, both on the part of people asking for help, and on the part of those providing help.

        Make A Donation https://www.paypal.me/KevinRubio

        Comment


        • #5
          Originally posted by Vege View Post
          Why pass the oldimage id/name in the hidden field in the first place? Query it again when saving.
          THIS. THIS! A thousand times this!!!

          If it's secure information, you have ZERO business passing it client-side in the first place. If it were something I didn't want to waste time querying again manually, I'd store it in the $_SESSION on the server, and not derping it client side where it could be made invalid, or abused to possibly be hacked, or wasting bandwidth on something you don't need.
          "It is amazing what can be accomplished when nobody cares who gets the credit." -- Kelly Johnson
          http://www.cutcodedown.com

          Comment


          • #6
            Many thanks everyone for a great response.
            I can see now that storing the value in a SESSION['oldimage'] is the best way to go, no need for hidden form fields.

            PHP Code:
            $_SESSION["oldimage"]=$image;
            $newimage=$_FILES['upload']['name'];                        
            unlink("uploads/".$_SESSION["oldimage"]);
                    
            move_uploaded_file($_FILES['upload']['tmp_name'],"uploads/".$newimage);                           
             }                                
            }else{        
            // if the image is not replaced, keep the original image details        
            $newimage=$_SESSION["oldimage"];

            Thanks again.
            Maxwell

            Comment

            Working...
            X