URL?name=value NO NO NO!!!!!

Anon

I have an online questionnire @

http://www.lanenuff.com/questionnaire/gamemore_questionnaire_test.php

I am using the switch function to allow the user to be taken through the questions/sections in a logical fashion, from one section to the next. This is done through passing through a hidden variable that tells the switch which question/section that needs to be displayed.

I have discovered that this whole process can be bypassed using the following:

http://www.lanenuff.com/questionnaire/gamemore_questionnaire_test.php?stage=4

I want to be able to stop people from accessing the sections via using a url to pass the stage. I only want people to be able to proceed through the questionnaire using the submit buttons.

Does anyone have any ideas coding wise?

halfling

What method does your form use?
If it is a POST, then you should try to access the stage variable through $_POST['stage'] or $HTTP_POST_VARS['stage'] if you are using an old version of PHP
be sure to have register_globals = off to your ini file.

that way, if the added a ?stage=4 to the url it wud be stored in $_GET['stage'] ot HTTP_GET_VARS['stage'] and not in the POST arrays

If you are using a GET method, change it to POST 😛

But since they can even insert their variables through POST with some extra time spared, if you REALLY need them to follow your directions, use session control...

Hope that helped.. cya!