[RESOLVED] Validate Radio Buttons?

Rivet

Hi,

Windows 7, XAMPP, PHP 5.3x on both local and remote servers; local shows all errors.

The short question is: Should Radio Buttons be validated in PHP?

The detailed question is:
I've been under the impression for a long time that Validating Radio Buttons wasn't necessary. I'm using them for 2 purposes:
1. A Ratings system (0 to 9) and a small area just to confuse robots where there is no answer that will satisfy the checks except Empty. Any errors in the latter section shuts everything down and sends the user to spamcop.net right now.

Since there IS no input other than ticking a radio button, I don't see why it would need validation. Would anyone care to explain why I might want to?

I've come across a website, the only one I've been able to find about radio button validation (maybe that's a hint) at http://phpmaster.com/form-validation-with-php/ that uses an awful lot of code just to validate the radio buttons.:queasy:
It sort of makes sense, but ... the going back to any page in my forms and finding the data still filled in is almost impossible as far as my tests have gone, using Headers for Cache Control and Pragma (html 1.0).
That and destroying my SESSION and sending the user back to the web site Home Page up to 3 times, after which they are banned for a couple hours, and banned forever if there are two repeated attempts that appear similar. My Host sends me a daily report on all website activity they collect. That helps immensely, I think. We're near a college town and so far the only attempts I've seen that misbehaved were .edu originated.

[EDIT] Almost forgot; I'm also using $referrer; you can only have arrived from the intended preceding page; website, PREVIOUS form pages. [/EDIT]

Hope I've been able to make this clear enough.

I prefer to not post any code for good reasons, but ... overall, I'd like to know if Validating Radio Buttons is really a needed operation?

Thanks for reading,

Rivet`

bradgrafelman

Rivet;11031787 wrote:
Should Radio Buttons be validated in PHP?

Validated in what way? Should you check for their existence before assuming the user even made a selection? Of course. Should you then simply use the value as if it couldn't possibly have been altered? Absolutely not.

A radio button deserves the same validation a simple text box receives; both could contain any malicious values that the user desired (e.g. in order to perform a SQL injection attack).

Rivet;11031787 wrote:
[EDIT] Almost forgot; I'm also using $referrer; you can only have arrived from the intended preceding page; website, PREVIOUS form pages. [/EDIT]

I'd advise against that (or at least advise caution) for a few reasons:

It can easily be spoofed (it's just a header coming from the client, after all)
It can likely be disabled by the user (especially those tin-foil-hat-wearing "privacy" freaks 🙂)
An intermediate gateway/proxy might even be stripping the Referer header out (and/or just not relaying it in its own request to your server)

Rivet;11031787 wrote:
I prefer to not post any code for good reasons

I can't think of any good reasons why you wouldn't want to post code. When it comes to security, open-source is going to win over closed-source. I actually heard this argument made in one of my college courses, and after giving it some thought I ended up agreeing.

For now, though, just consider $POST['radio_button_1'] no different than $POST['text_area_1'] because both are the same in the end: user-supplied data.

Rivet

bradgrafelman;11031789 wrote:
Validated in what way? Should you check for their existence before assuming the user even made a selection? Of course. Should you then simply use the value as if it couldn't possibly have been altered? Absolutely not.

[ OK, understood! :o I hadn't considered SQL injection because I still need to learn more than the peripheries of it. That said, I think you've clarified a lot for me here! ]

A radio button deserves the same validation a simple text box receives; both could contain any malicious values that the user desired (e.g. in order to perform a SQL injection attack).

I'd advise against that (or at least advise caution) for a few reasons:

It can easily be spoofed (it's just a header coming from the client, after all)

It can likely be disabled by the user (especially those tin-foil-hat-wearing "privacy" freaks 🙂)

An intermediate gateway/proxy might even be stripping the Referer header out (and/or just not relaying it in its own request to your server)

I can't think of any good reasons why you wouldn't want to post code. When it comes to security, open-source is going to win over closed-source. I actually heard this argument made in one of my college courses, and after giving it some thought I ended up agreeing.

For now, though, just consider $POST['radio_button_1'] no different than $POST['text_area_1'] because both are the same in the end: user-supplied data.

Yup; the old saw about never trusting any user input still applies.

Best Regards,

Rivet`