Last Forth of July we had a hacker use one of the forms on a client website to send out thousands of e-mail messages. We worked all day to find out what the issue was and fix it. This is part one of a multi-part series on making sure your forms are secure.
For each of your fields you need to determine if a plain text field is the best form control to use. If a question has a finite number of answers I suggest that you use a drop down selection control, radio buttons or check boxes. Which you use will be determined by the data being selected. Radio buttons are good for either or selections, yes or no. Check boxes are good for a small amount of choices where the user can select multiple. The drop down selection control works well for long list of data such as state or country.
This post will focus on the client side programming you can use to help prevent form abuse. The most common client side programming uses JavaScript as the programming language. For each of the text fields on your form you should decide if you want the data to be required or optional. The first step to secure your forms is to use JavaScript to make sure that required fields are filled.
This script is one of the easiest to implement that I have found: http://javascript.internet.com/forms/basic-validation.html. All you have to do is add the word required to the names of your fields and include the script. If you only want to make sure that required fields have values, use this script.
The next level would be to check that the field data contains correctly formatted data. If it is a date field, use a script to check for a valid date. If it is an e-mail field, use a script to check for a valid e-mail. You can find many scripts to validate fields at
http://javascript.internet.com/forms/.
The next level is to prevent invalid data from being entered into the field. If it is a date field, only allow numbers and dashes or slashes to be entered. If it is a phone number field only allow numbers and dashes. You can use a script that creates a mask for the data. A mask define the format for a field. A mask for a phone number might be (###) ###-####. If you would like to have masks for your fields you can use this script: http://javascript.internet.com/forms/dfilter.html.
The last thing on the client side that I would suggest is to use JavaScript to insert a hidden field into your form with data that can be validated on the server. I use an MD5 JavaScript function to place a field in the script based on a seed term. I then check for the hidden field’s value to make sure in has the correct data. Neither the field nor the data is visable in the html code of the page.
All of this still does not completely secure the form, but, if your form is harder to break into than the average site most hackers will look for an easier site to hack.
Tags: Programming Help by Fred - No Comments »