Ok, so I'm building a website for the RIA I am developing. I have got to the signup page, and have successfully managed to validate the sign up form on the server side using my own hand written jquery code (no plugins).

 

Naturally, the sign up form passes its data to a back-end script to be validated and put into the mysql database. However, because the server side validation is already in place and working rather well, is there actually a reason to write extra validation code on the back-end?

 

Yes, I know traditionally that if javascript is disabled the form won't be validated, however the form is actually submitted via a jquery $.ajax request, making the form 'unsubmittable' if javascript isn't enabled. (The app the website hosts requires javascript, among others, so I consider it to be a requirement to even view the web page).

 

So, aside from the case where javascript is disabled, is there another reason to validate forms on the server side too?

 

Hope this makes sense, thanks in advance guys.

Ok, so I'm building a website for the RIA I am developing. I have got to the signup page, and have successfully managed to validate the sign up form on the server side using my own hand written jquery code (no plugins).

 

Naturally, the sign up form passes its data to a back-end script to be validated and put into the mysql database. However, because the server side validation is already in place and working rather well, is there actually a reason to write extra validation code on the back-end?

 

Yes, I know traditionally that if javascript is disabled the form won't be validated, however the form is actually submitted via a jquery $.ajax request, making the form 'unsubmittable' if javascript isn't enabled. (The app the website hosts requires javascript, among others, so I consider it to be a requirement to even view the web page).

 

So, aside from the case where javascript is disabled, is there another reason to validate forms on the server side too?

 

Hope this makes sense, thanks in advance guys.

 

Yea their is validating forms is not only good practice but it prevents spam and other security issues so yea you always wanna validate.

It sounds like if you just used the JQuery for validation you could potentially be open to an XSS attack which bypasses your JQuery validation and submits directly to your database script which has no validation leaving your database open to all manner of attack.

If the form is visible and submittable without Javascript enabled - then you need to sanitize/validate the data. If you print any of the variables from the $_POST array back to the screen in the case of errors, make sure you strip out any scriptable tags too.

You could get around this by inserting the whole form into the DOM with JS - that way, the form won't even exist unless JS is active.

A server-side form handling script is an essential component of a developers toolbox, it's worth rolling your own for long term use, or borrowing one. Jemjabella has a great free form script on her site:

http://www.jemjabella.co.uk/scripts/

It sounds like if you just used the JQuery for validation you could potentially be open to an XSS attack which bypasses your JQuery validation and submits directly to your database script which has no validation leaving your database open to all manner of attack.

Ouch, sounds nasty, I'm relatively new to all of this, what's an XXS attack?

 

 

If the form is visible and submittable without Javascript enabled - then you need to sanitize/validate the data. If you print any of the variables from the $_POST array back to the screen in the case of errors, make sure you strip out any scriptable tags too.

You could get around this by inserting the whole form into the DOM with JS - that way, the form won't even exist unless JS is active.

A server-side form handling script is an essential component of a developers toolbox, it's worth rolling your own for long term use, or borrowing one. Jemjabella has a great free form script on her site:

http://www.jemjabella.co.uk/scripts/

Thanks a lot, looks like sound advice to me. I'll get working on that server side script, quite into rolling my own code so it's nice and streamlined.

I have got to the signup page, and have successfully managed to validate the sign up form on the server side using my own hand written jquery code (no plugins).

If the validation is JavaScript (jQuery), then it's client side validation & not server side.

 

Just because you're sending the data through your form using a jQuery $.ajax request doesn't mean the form is unsubmittable with JS disabled - I could, for example, still create a form on my own site and POST data to your data processing script bypassing all client-side validation.

 

Always validate data.

If the validation is JavaScript (jQuery), then it's client side validation & not server side.

 

Just because you're sending the data through your form using a jQuery $.ajax request doesn't mean the form is unsubmittable with JS disabled - I could, for example, still create a form on my own site and POST data to your data processing script bypassing all client-side validation.

 

Always validate data.

 

Exactly.

Sorry I didnt reply earlier Lovinghombre. XSS = Cross site scripting.

Search XSS on the internet you will find many a site and if you want to have some things to test on your site for XSS use these its basically user inputted javascript then when someone visits the page does something malicious, most of the examples on the site I linked to are just alerts and cant do anything more but it helps with the clearing up of bugs.

I think you're referring to the XSS cheat sheet: http://ha.ckers.org/xss.html

 

And yes, they're "just" alerts - but the point with the cheat sheet is that if the alert works, so will other more malicious input.

Thanks again for all the replies everyone. I did some research into XSS and it's certainly opened my eyes to a lot of things.

 

I've validated the php script to prevent html and scripts getting submitted, using htmlspecialchars() / strip_tags().

 

Any ideas which one I should use? (I understand what each of them does, I mean from a validation point of view).

 

Now I've validated the strings and prevented data getting submitted to the form any other way, what else can I do to protect the page? Can anybody send me a link to the most common website attacks and their solutions?

 

Cheers chaps.

Are you asking which should you use out of htmlspecialchars and strip_tags? Both. strip_tags first to get rid of any html, then htmlspecialchars to deal with any left over stray characters ( < > & etc). If you're working with a database you should also use mysql_real_escape_string (or prepared statements).

 

With regards to other common attacks, I have some good bookmarks here: http://delicious.com/jemjabella/security

 

Ps. less of the 'chaps' if you don't mind

Thanks Jem, that has really helped! I'll get on that delicious list just now.

 

Ps. less of the 'chaps' if you don't mind

 

Just a habit of mine, sorry!

Hehe, it's ok, I'm only messing