Hide form input names?

[ADM]

I want to be able to have a user submit a high score through a html form and then using that I'll be able to easily just put it into a database.

But the input names of the forms get displayed in the html.

So in other words someone can just go straight to the submission page and add ?inputname1=XXX&inputname2=xxx

and so on.

is there any way to hide the input names so they can't see them and get around it that way?

[vornn]

Use the post method to submit your form.

like this:

<form action="page.php" method="post" name="add2cart" >

[ADM]

But would they be able to go around that? by manually entering it?

[onion2k]

When you generate the input form, create a code and put it in a type="hidden" field. Then, if the code isn't right when the form is submitted you'll know the score is a fake..

I'll leave how you make the code and check it up to you..

[ADM]

Thanks..

I'll try think of the easiest way to do that.

[ahundiak]

Just be aware that using POST is only a tiny bit more secure than GET. The user can easly edit the html and submit modified POST values. Never trust any submitted data.

[Weedpacket]

Originally posted by ahundiak
Just be aware that using POST is only a tiny bit more secure than GET. The user can easly edit the html and submit modified POST values. Never trust any submitted data.

I'd say something stronger than that: never trust anything from the outside world. It can send you anything at all, and there's really nothing you can do that will stop it from making the attempt.