validating form challenge questions

BEFOR

Can submit()) be used as below without its own function?
What can trip the form action in the event the posted $visitorAns equals the trueanswer? (security challenge question that prevents/allows form submit)

The below is letting everything pass.


<?php 
$visitorAns = $_POST['chalQ']; //the commentor answer to a challenge question that is being checked against the $trueanswer, a recorded answer

if(($_POST['submit']!='') && ($isset_Post['chalQ']) && ($visitorAns = $trueanswer))
{echo (submit());
}
elseif ($_POST['submit']!='') {echo "You have not answered correctly";} ?>

Must register_globals be turned on for this to process (register_globals currently are turned off)? Is there another way with php and not javascript?

Trying to perform this check before the POST values are sent to another page for validation/inserting.

Krik

if(($_POST['submit']!='') && ($isset_Post['chalQ']) && ($visitorAns = $trueanswer))

Note that line is setting $visitorAns to $trueanswer so it will return "true" and will let the visitor continue if the other 2 checks are also "true". You need to use "==" if you wish to compare them.

Can submit()) be used as below without its own function?

"submit()" is a method in javascript there is no equivalent in php and logically it is not possible as php can not trigger a form to submit. PHP runs at the time a page is requested and once it finished processing, the code, the connection between the page and the PHP (server) is terminated and PHP can no longer can do anything to that page. A new http request must be made from the browser (user or javascript) for php to do anything and event if it is the refresh button php will act like it is loading a new page, it has no way of directly interacting with the previous page.

Trying to perform this check before the POST values are sent to another page for validation/inserting.

As soon as the submit button is clicked the data and user are sent to the page in the "action" of the form. The only way to stop the page from going to the "action" page is to use javascript.

Must register_globals be turned on for this to process (register_globals currently are turned off)?

register_globals has nothing to do with this. Leave them off unless you sure you can write your code to avoid the security risk that is associated with having them on. And even then there is really no good reason to turn them on.

Now, You can use php to validate the user input before anything on the new page is displayed. So if the users input is not what it should be send them to one location, and if it is send them to another location.

<?php
if ((isset($_POST['chalQ'])) && ($_POST['chalQ'] == $trueanswer)) {
    header("Location: http://www.yoursite.com/nextpage.php");
}
else {
    header("Location: http://www.yoursite.com/previouspage.php");
}
?>

You may want to read up on the [man]header[/man] function before you try too much though, it is very particular about how it can be used.

You may find [man]include[/man] easier to work with

<?php
if ((isset($_POST['chalQ'])) && ($_POST['chalQ'] == $trueanswer)) {
    include 'nextpage.php';
}
else {
    include 'previouspage.php';
}
?>

BEFOR

Kri,

Much appreciate your reply. Given the nature of php, then, I'll be performing this check on the 2nd pg.

In the past, I've been able to make calculations on the initial form page and output to the same page as the entire results but this was a little misleading to me currently, since before, the form action was being sent to the same page.

I've familiar with the header redirect and like using it. I'm wondering though really what advantage there might be in using it, other than keeping malicious hackers away from the main insert page. While at the same time, if I perform this check first on this 2nd insert page, ahead of other checks, I'm not sure it can be gotten passed.

It seems if I do the redirect to an error from the challenge question alone, and a hacker gets his or her hands on the address of the seperate insert page, it could be more open season. What do you think?

BTW -- the main challenge question is being randomly called out of a pool of about 20 such written questions. Which means someone would have to make a human attempt/not machine, and succeed with a single question/answer of course.

Krik

In the past, I've been able to make calculations on the initial form page and output to the same page as the entire results but this was a little misleading to me currently, since before, the form action was being sent to the same page.

It is quite common to submit a form to the same page using an if/else to determine what the user sees. In reality the second example I gave could work that way.

It seems if I do the redirect to an error from the challenge question alone, and a hacker gets his or her hands on the address of the seperate insert page, it could be more open season. What do you think?

I would hope the "error" redirect is different than the page for the correct answer. But I was not thinking of the fact you were using this check to stop auto postings, as that is the obvious use for what your doing. If the redirect page url for a correct answer is seen by a hacker they could circumvent your check depending on how you code it. So I would think using "include" would be the better option. As then the validation code will always be there to check if the form has been submitted first and then includes the appropriate file. And the hacker will have no way of knowing what page was included.

BTW -- the main challenge question is being randomly called out of a pool of about 20 such written questions. Which means someone would have to make a human attempt/not machine, and succeed with a single question/answer of course.

If you have low security risk 20 may be fine. But if a hacker figures that out he will have his "bot" keep refreshing the page with the same answer till it takes. And for the bot to have to run even a couple hundred page refreshes to get the right answer is not unreasonable.

If you have a higher security risk You could look at free utilities like recaptcha http://recaptcha.net/. Either that or you will want a lot more questions. Even a 100 questions could prevent a hacker from realizing that you have a limited number of questions.

BEFOR

...used to stop auto postings..."include" would be the better option...As then the validation code will always be there to check if the form has been submitted first and then includes the appropriate file.

On the 2nd successful page redirected to, to check if the form has been submitted that the first page was just departed from) -- this reliable/still present and might it be a duplicated by a hacker in a php check?

if(($_POST['submit']!='') //with the rest of the snippet

Almost sounds like the check $_POST['chalQ'] == $trueanswer should be performed on the first page, then again on the 2nd prior to insert.

On the 2nd page -- how about checking against yet another variable that is only present only on either the 1st page or an include/require_once page?

BEFOR

Even after reviewing includes I have no idea on how to carry out what you suggest, for

<?php
if ((isset($_POST['chalQ'])) && ($_POST['chalQ'] == $trueanswer)) {
    include 'nextpage.php';
}
else {
    include 'previouspage.php';
}
?>

This is on the form action page I take it? If it does not redirect, I have to assume it is similar to the include_once. In which case, I'm not sure how to execute this.
Is the code automatically executed without showing -- assuming the insert works without the include?

Krik

Include, include_once, require and require_once are all very similar. Basically using anyone of them inserts the php of the file that is being "included" just like if you had all the php from that file in the if/else.

So basically make a php file, it can have almost any PHP, HTML, Javascript or CSS in it and then "include" it in the if/else and see what happens.

If this is the correctanswer.php

<?php
    $var ="hello world";
?>
<html>
    <head>
        <title>Correct Answer Page</title>
    </head>
    <body>
        <div style="width: 500px; font-size: 30px; text-align: center;"><?php echo $var; ?></div>
    </body>
</html>

And this is the wronganswer.php

<?php
    $var ="Wrong Answer";
?>
<html>
    <head>
        <title>Wrong Answer Page</title>
    </head>
    <body>
        <div style="width: 500px; font-size: 30px;  text-align: center;"><?php echo $var; ?></div>
    </body>
</html>

And this is the include

<?php
if ((isset($_POST['chalQ'])) && ($_POST['chalQ'] == $trueanswer)) {
    include 'correctanswer.php';
}
else {
    include 'wronganswer.php';
}
?>

All that is the same as doing this

<?php
if ((isset($_POST['chalQ'])) && ($_POST['chalQ'] == $trueanswer)) {

$var ="hello world";
?>
<html>
    <head>
        <title>Correct Answer Page</title>
    </head>
    <body>
        <div style="width: 500px; font-size: 30px;  text-align: center;"><?php echo $var; ?></div>
    </body>
</html>
<?php
}
else {

$var ="Wrong Answer";
?>
<html>
    <head>
        <title>Wrong Answer Page</title>
    </head>
    <body>
        <div style="width: 500px; font-size: 30px;  text-align: center;"><?php echo $var; ?></div>
    </body>
</html>
<?php
}
?>

I have build sites that have had 20 or more includes in a single page load and many times there is an include inside an include that is in another include. Or I will have one of the nested includes refer to a function that was in a totally different included file.

Includes just allow you to break up your code so that you don't end up with a file that is 10,000+ lines long which can make it difficult to find where different parts of the code were placed in the file.

BEFOR

I decided to go with the header redirect .

Noticing the Post variables are lost on redirect, are these normally passed from here on as an array or how?

One of the form variables can have up to a couple hundred characters -btw.

BEFOR

Actually, I'm not going with the header redirect. - want to maintain use of the back button for commentor field corrections.

I would hope the "error" redirect is different than the page for the correct answer. But I was not thinking of the fact you were using this check to stop auto postings, as that is the obvious use for what your doing. If the redirect page url for a correct answer is seen by a hacker they could circumvent your check depending on how you code it. So I would think using "include" would be the better option. As then the validation code will always be there to check if the form has been submitted first and then includes the appropriate file. And the hacker will have no way of knowing what page was included.

I'm still weighing this.

Would definitely like to stop/prevent auto postings and email server attacks (though the page has yet to go live). I use the includes file for validating the challenge question alone now, but, even if the insert code is on another include page (if this can be done) does it really matter security-wise if the needed variables exist on the 'visibile'page anyway? I am escaping special characters on insert with backslash.

Is there any real way of protecting against 'send email' function exploits? Would it be practical to have a file in a password protected directory that does a row count query, and triggers an email to the admin on added rows (would the page have to be opened in a browser to execute)? That is, instead of having it trail the insert string on success.

robinjackman

really great information sharing and thanks for that.

Krik

If you are trying to prevent an attacker from using a script to auto submit the email form you may want to look into something like a captcha, http://recaptcha.net/ is a nice free one.

Outside of an automated script a person could do a couple types of attacks and all of them can be prevented with relative ease as php has some nice built in security tools, like, [man]mysql_real_escape_string[/man], [man]strip_tags[/man], [man]htmlentities[/man], [man]intval[/man] ect. There is a variety of simple methods to remove or change any character that could potentially be used to cause problems.

Here's an example that can give you some ideas

$data = htmlentities($data, ENT_QUOTES);

$data = strtr($data, array('(' => '&#40;', ')' => '&#41;'));

$securedata = mysql_real_escape_string($data);

If you want to learn more do some searches on XSS (Cross Site Scripting), SQL injection, and CSFR (Cross-Site Request Forgery) attacks. A general search to for secure form validation will turn up a lot. Also look up information on eval, register globals and magic quotes.

Here is an article I found with a quick search that briefly touches on all them http://php.robm.me.uk/#toc-SpoofedFormInput

but, even if the insert code is on another include page (if this can be done) does it really matter security-wise if the needed variables exist on the 'visibile' page anyway?

I wanted to make quick comment on the "if the needed variables exist on the 'visibile' page". The variables are never visible to the user so it doesn't matter. PHP is entirely processed serve side and the user never sees any PHP. The server only outputs HTML, CSS or Javascript to the browser. Any attacker is going to have to work hard to find a weakness in your code.

Therein, a big part of security is how you handle errors, most attackers find wholes do to error reporting. Even if an error occurs have the page load like nothing serious happened and then use friendly error reporting. Example: "We're sorry your email could not be send. Please try again." This gives absolutely no clue as to what went wrong but allows you to still let "friendly" users know if there was a problem.

BEFOR

Krik,

Thanks for the thought out reply. A few notes on my completed form:

there is no log in/username password
the form requires email, but does not send out to these addresses, only the admin is notified via email
validations for all fields do not allow :;or <> ) ( + = * ^ and all other special chars except for those found among the next entry below (which should prevent linking and code tags, to say the least)
special characters that are allowed have str_replace applied to them which are
? & % $ ! ' " , _ for entering a preceeding backslash [/COLOR]
this I beleive does pretty much the same thing as mysql_real_escape_string()
content is then echoed back with stripslashes
the email only allows email characters. the name field only allows letters. and the comment section allows the characters listed above with letters and numbers.
there are no auto postings, everything is reviewed and switched to a 'live column' on approval.

I wanted to make quick comment on the "if the needed variables exist on the 'visibile' page". The variables are never visible to the user so it doesn't matter.

Even so, the insert snippet itself is conditional on a defined variable from an includes file. Nothing will insert unless all fields validate and the challenge question is right which calls this variable value from the includes file.

Also, I've decided not to provide error messages for independent field validation. For the "name" "email" "comment" and challenge question. Making it less likely for anyone to focus on weaknesses.

Krik

Sounds like you have most of your bases covered.

I would add a final thought. While having the best security is great, I would note that unless you have something of real value to be taken you don't need to work too hard at it. You have to realize every security procedure you put in place makes it that much more difficult to manage your code or find problems. Its a bit of balancing act.

While every site has some risk of being attacked you have to realize that at best you may have to deal with a roaming malicious bot (they are fairly dumb). So unless there is real value in harvesting your data hackers will not usually directly bother with a site that can't get them a good chunk of $$$, one way or another.