Originally posted by inthestars
I think the client means that the form can be submitted from anywhere online. You'll need to make sure that the form is submitted from the site; i.e. results can only come from a particular URL and no other.
Well, any reasonable user authentication would make that moot, since only authenticated users would be able to make submissions anyway, wherever their requests come from.
I wouldn't suggest checking $_SERVER['HTTP_REFERER'] to discover the URL of the page that submitted the form, since the browser is under no obligation to provide that information.
Originally posted by babochan
Like mapping OPTION value ... does anybody actually do that?
Well, I've never found a need to - generally, the number used in the OPTION field had no meaning beyond referring to a primary key in a db table being used to maintain that list. If it could potentially be used elsewhere by the user, in a situation where they would otherwise not have permission, then that might be construed as a risk (kind of analogous to using the same password for everything, and then giving it to someone so that they can check your email for you). In that case, a dynamic remapping wouldn't be needed, just a unique identifier that can be kept in the option table.
But really, it's just an idea that occurred to me as an instance of the first corollary to the sixth of the Twelve Networking Truths.
