Is it hacking when....?

[shingabiss]

I have a web site that has an HTML form with some Javascript for checking form fields and a PHP script that handles the information on the server side and returns a page to the submitter.

In my HTML/Javascript page, I have date entry combo boxes; mm/dd/yyyy. I also use the Javascript to take care of correcting the date aspects when the user changes values; correct num of days in month etc. The year fields (for arriving and departing dates) only have the current year and next year, as inserted by the body Javascript. Sorry for the long-winded explanation but I felt it necessary to explain the occurance and questions.

What happened that is weird is that I received a form submission (via email from the above mentioned script) that had year values of 1793 in both fields. As the two fields are not alterable to the user, i.e. can't enter own data, how did this occur? I have two theorys, one being that this is some sort of browser-specific anomaly and the Javascript didn't execute properly or the user hacked into the code and added these silly dates. For a test, I disabled Javascript in my browser and tried filling in the form and changing the dates; couldn't do it and wouldn't even submit (as I should have realized, as the submission is handled by an "onClick" event).

Can someone copy and edit your script and change the form's action to a full path in order for it to find my site's php script then submit it and my php code will, in blissful ignorance of the outside submission, process it as if it's a normal on-server submission?

This is a bit irritating!

Thanks.

Scott Ross

[AricC]

I have a web site that has an HTML form with some Javascript for checking form fields and a PHP script that handles the information on the server side and returns a page to the submitter.

In my HTML/Javascript page, I have date entry combo boxes; mm/dd/yyyy. I also use the Javascript to take care of correcting the date aspects when the user changes values; correct num of days in month etc. The year fields (for arriving and departing dates) only have the current year and next year, as inserted by the body Javascript. Sorry for the long-winded explanation but I felt it necessary to explain the occurance and questions.

What happened that is weird is that I received a form submission (via email from the above mentioned script) that had year values of 1793 in both fields. As the two fields are not alterable to the user, i.e. can't enter own data, how did this occur? I have two theorys, one being that this is some sort of browser-specific anomaly and the Javascript didn't execute properly or the user hacked into the code and added these silly dates. For a test, I disabled Javascript in my browser and tried filling in the form and changing the dates; couldn't do it and wouldn't even submit (as I should have realized, as the submission is handled by an "onClick" event).

Can someone copy and edit your script and change the form's action to a full path in order for it to find my site's php script then submit it and my php code will, in blissful ignorance of the outside submission, process it as if it's a normal on-server submission?

This is a bit irritating!

Thanks.

Scott Ross

Scott,
From what you're describing I wouldn't say someone hacked your site. I'm not sure why this would occur, but generally when a person hacks he would trash the site not submit the form. If you post a link we can check it out, also how secure is your PHP?

[shingabiss]

Scott,
From what you're describing I wouldn't say someone hacked your site. I'm not sure why this would occur, but generally when a person hacks he would trash the site not submit the form. If you post a link we can check it out, also how secure is your PHP?

Hello and thanks for your reply. The site is www.pioneergetaway.com and the page in question is on a link at the bottom to www.pioneergetaway.com/rentalrequestformjs.html

I'm not sure how secure the php is; the ISP is easycgi.com.

Scott

[acoder]

I have a web site that has an HTML form with some Javascript for checking form fields and a PHP script that handles the information on the server side and returns a page to the submitter.

In my HTML/Javascript page, I have date entry combo boxes; mm/dd/yyyy. I also use the Javascript to take care of correcting the date aspects when the user changes values; correct num of days in month etc. The year fields (for arriving and departing dates) only have the current year and next year, as inserted by the body Javascript. Sorry for the long-winded explanation but I felt it necessary to explain the occurance and questions.

What happened that is weird is that I received a form submission (via email from the above mentioned script) that had year values of 1793 in both fields. As the two fields are not alterable to the user, i.e. can't enter own data, how did this occur? I have two theorys, one being that this is some sort of browser-specific anomaly and the Javascript didn't execute properly or the user hacked into the code and added these silly dates. For a test, I disabled Javascript in my browser and tried filling in the form and changing the dates; couldn't do it and wouldn't even submit (as I should have realized, as the submission is handled by an "onClick" event).

Can someone copy and edit your script and change the form's action to a full path in order for it to find my site's php script then submit it and my php code will, in blissful ignorance of the outside submission, process it as if it's a normal on-server submission?

This is a bit irritating!

Thanks.

Scott Ross

What's 107 and 108? Isn't that supposed to be 2007 and 2008?

Are you sure you're checking on the server-side in your PHP script? Never depend on javascript for validation. Yes, it helps, but it's easily sidetracked by disabling javascript.

[shingabiss]

Uh...er...well, no (he said sheepishly). If Javascript was disabled the form wouldn't submit as it's handled by a regular button (Not a submit type) with an onClick event associated with it.

I used to use a Perl script that I wrote for all form validation but thought I'd try Javascript. I think you're right about double checking with the PHP script.

What i still don't understand is how the 1797 date was "inserted". If the script was altered on the person's pc, can they still submit it to my server side PHP script and it would run as if it was submitted from my site?

Thanks for your time!


Scott

[acoder]

Yes, that is very easy to do. See this link. You must have server-side validation. It seems someone has done exactly what you're suspecting, though I can't be certain.

[shingabiss]

Very informative article, thanks. As it is with most things in life, it seems obvious after the fact. Appreciate the help.

Scott

[acoder]

No problem. You're welcome.

[iam_clint]

although i did try messing with your form a little


[color=#ff0000]It's Not Nice To Fool With People's Web Pages![/color]



i got this :) very nice.

[shingabiss]

I added something to the PHP to "foil" year changes. Glad you liked it!

Thanks for taking the time to hack around.

Scott

[AricC]

Yes, that is very easy to do. See this link. You must have server-side validation. It seems someone has done exactly what you're suspecting, though I can't be certain.

For awhile, I only did client side validation. A few months ago ACoder posted that link with his idea that using only client side isn't the way to go. I've gone back and added server side form validation. Great article.