Protecting hidden fields in HTML Form

imlek · 08-22-2004, 08:18 AM

Hi,

I'm using HTML Form to send information of my visitors (Visitor submit this form directly) to destination.com as follow:

<form name="form1" action="http://destination.com/receiver" method="post">
<input type="hidden" name="Login" value="My-Username">
<input type="hidden" name="Passwd" value="My-password">
<input type="hidden" name="Cust" value="John Doe">
<input type="hidden" name="Total" value="100">
<input type="submit" value="Submit">
</form>

This HTML Form is the only method that destination.com can accept.

But this is very big security issue, since people can use 'View Source' and get my login and username.

How to protect my login and password from being viewable to the world but the form still work ? May be hide it somewhere? Or other method?

Please advice.

Thank you.

Curly Brace · 08-23-2004, 07:59 PM

If your destination.com accepts GET variables, you can try this code. I hope it could be clear without comments.

PHP Code:


			
<?php

if(isset($sub)){

    header("Location: http://destination.com/form_reciever.php?login=blah&passw=blahblah&cust=$cust&total=$total");

}

?>

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">

<html>

<head>

<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">

<title>FORM</title>

</head>



<body>

<form action="<?php print $PHP_SELF ?>" method="post">

<input type="hidden" name="cust" value="John Doe">

<input type="hidden" name="total" value="100">

<input type="submit" name="sub" value="Submit">

</form>

</body>

</html>

imlek · 08-25-2004, 05:15 AM

Thanks a lot.

08-22-2004, 08:18 AM	#1
imlek Registered User Join Date: Aug 2004 Posts: 2	Protecting hidden fields in HTML Form Hi, I'm using HTML Form to send information of my visitors (Visitor submit this form directly) to destination.com as follow: <form name="form1" action="http://destination.com/receiver" method="post"> <input type="hidden" name="Login" value="My-Username"> <input type="hidden" name="Passwd" value="My-password"> <input type="hidden" name="Cust" value="John Doe"> <input type="hidden" name="Total" value="100"> <input type="submit" value="Submit"> </form> This HTML Form is the only method that destination.com can accept. But this is very big security issue, since people can use 'View Source' and get my login and username. How to protect my login and password from being viewable to the world but the form still work ? May be hide it somewhere? Or other method? Please advice. Thank you.

08-23-2004, 07:59 PM	#2
Curly Brace Rock is alive! Join Date: Jun 2004 Location: Russia Posts: 603	If your destination.com accepts GET variables, you can try this code. I hope it could be clear without comments. PHP Code: <?php if(isset($sub)){ header("Location: http://destination.com/form_reciever.php?login=blah&passw=blahblah&cust=$cust&total=$total"); } ?> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <title>FORM</title> </head> <body> <form action="<?php print $PHP_SELF ?>" method="post"> <input type="hidden" name="cust" value="John Doe"> <input type="hidden" name="total" value="100"> <input type="submit" name="sub" value="Submit"> </form> </body> </html>

08-25-2004, 05:15 AM	#3
imlek Registered User Join Date: Aug 2004 Posts: 2	Thanks Thanks a lot.

Thread Tools
Show Printable Version Email this Page
Display Modes	Rate This Thread
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode	Rate This Thread:


<a href='http://d1.openx.org/ck.php?n=ac86e9f0&cb=INSERT_RANDOM_NUMBER_HERE' target='_blank'><img src='http://d1.openx.org/avw.php?zoneid=36053&source=_blank&cb=INSERT_RANDOM_NUMBER_HERE&n=ac86e9f0' border='0' alt='' /></a>