Securing Select tage

[smartic]

how can i secure the select tag from bad entry ex: select tag for countries

[ak1dnar]

how can i secure the select tag from bad entry ex: select tag for countries

That's better if you can explain the problem statement more, probably with an example. Its really not clear enough for me (us).

[smartic]

I'm having select tag that have countries names.
EX: i want to stop the user from entring any data when he useing the page offline.
I know that any one can save the page and can work on it offline and can enter bad data how can i solve this problem.

[HTML]
<select name="select" id="select">
<option>Canada</option>
<option>China</option>
<option>United States</option>
</select>
[/HTML]

[ak1dnar]

Match the domains using $_SERVER['HTTP_REFERER'] before execute the back end scripts. Read this article and the comments too.

[ronverdonk]

Match the domains using $_SERVER['HTTP_REFERER'] before execute the back end scripts. Read this article and the comments too.

There are circumstances where this will not be sufficient. See the PHP manual on this superglobal

'HTTP_REFERER'
The address of the page (if any) which referred the user agent to the current page. This is set by the user agent. Not all user agents will set this, and some provide the ability to modify HTTP_REFERER as a feature. In short, it cannot really be trusted.

Solution could be to generate the options content at the server side, e.g. using PHP from an array. After submission of the form the option can then be checked, server-side, against the array values.

Ronald

[pbmods]

Heya, smartic.

On the database side, you should be using either a primary key or an ENUM for the country field. This makes it physically impossible to store invalid data.

[kovik]

It sounds like the reason that you are worried about it being used offline is because people could change the HTML. I'm assuming that means you are unaware about the fact that this can be done live, as well as the posted data being altered before it is posted to the server.

This issue was one of the reasons that I built my form handler (it's not public yet, sorry). A simple solution would be to make sure you know all of the valid options and then check the posted value against them.

[php]$validOptions = array('China', 'Canada', 'United States');

if (!empty($_POST['country'])) {
if (in_array($_POST['country'], $validOptions)) {
echo 'You have made a valid selection.';
} else {
echo 'Error!';
}
}

echo '<select name="country">' . "\n";

foreach ($validOptions as $option) {
echo ' <option value="' . $option . '">' . $option . '</option>' . "\n";
}

echo '</select>' . "\n";[/php]

That's not tested, so... Test it. :P