Modify html before submitting form: prevent this hack

I came to a realization that malicious users can modify the html of a form in their browser before submitting a form. For example, switching the names of two input fields of the same types.

I am creating a website that's largely dependent upon rela开发者_如何转开发tionships between each entries in the database.

If this happens, it could jeopardize all functions of my sites. (I've tested it, and it does switched the inputs from the two fields who names are switched in the browser by the user, ie. me)

How could we prevent this?

---

If this kind of hack causes problem on the server side, you cannot fix it in your browser code. It means that you need to fix this on the server.

Anyone can generate any kind of POST or GET to your server, and you need to be prepared for that.

So, make sure that you detect this kind of tampering on the server, and deal with it there, by returning an error message, or by silently ignoring such invalid requests.

If the server is prepared for this, you can let people hack away in their browser as much as they want.

---

You should be validating your inputs as seen on the PHP Manual for Validation. For example, we have form inputs title and body for a post. When the user submits the post, the title should be between 1 to 40 characters, so we should validate that through PHP. Second, the body should not contain malicious text or code, so we should sanitize that with a function such as addslahes().

The entire topic revolves around PHP security. The only way to prevent hacking attempts and malicious intent is to learn security. Start learning with the link above.

---

As far as I know the simplest and often best solution is to check if each input field has a valid value with php before sending the query to the DB. For example, a field with the name "telephone" should only be numeric and not longer then say 10 ciphers. Make the rules strict enough and you shouldn't have any problems. In addition you should also make sure your DB fields are strict ie. only allow the length and data type you want.