A few questions about Form processing.?

Question

I would like to know the ways I could add more security to the forms so that I could prevent attacks. From the past few days of searching in the web, and the methodology I could adopt, I've found a number of solutions for which I would like to know your take before proceeding.

Is it always good to have include Form keys to prevent XSS (Cross-site scripting) and Cross-site request forgery?
Which is the best way to process the form data:
1. AJAX
2. Place the form processing code on top of the same page and process it using $_SERVER['PHP_SELF']
3. Set the action of the form to another page and process all the value from there.
4. Process the form value through a single PHP Class file.
Which is the best way I could filter or sanitize the form data?

Thank you

freesoftwaremagazine.com/articles/book_review_pro_php_security — KomarSerjio
client-side validation is all fine and dandy, but in the end you're depending on the client to do the right thing - think an attacker will care if you require that "first name" not be blank? Don't EVER depend on the client for anything and validate everything on the server. — Marc B

Dalton Conley Dalton Conley · Accepted Answer · 2011-02-09T20:25:28

Here is my normal set. I use a custom framework, basically.

I setup models that handle specific data. For example, if I have an employee form that creates new employees. I have an employee model. The model has specified values that it requires in order to generate a new employee in the database. If any values are missing in this model, when I try to save it, it will throw an exception. This is my second layer of "input validation". The first layer is a simple java script form validator, to make sure any values aren't missing.

Now, for any sort of input to the page(GET, POST), I have a class that handles these sanitation. It iterates over all of the $_POST and $_GET values and sanitizes them(mysql_real_escape_string, stripslashes in php).

Now setting up my form data in html.. php can process form data "arrays" and by that I mean if I have a form input named "employee[name]" and I submit that form, php will recognize that form submission as $_POST['employee']['name'].. pretty amazing I know. Now, each form has its own specified fields that are required to the model. I simply call my model, set the model data to $inputClass->post('employee') (which is an array) and save the data.

I prefer this general method to anything. Its fast and easy to setup, its secure and it works.

EDIT: Also, something like Ajax and Javascript are luxuries. You don't NEED these to process forms, they simply add ease to the user. For example, pending they have javascript enabled, you can validate the form without reloading the page. But note, you should always validate your forms via php as well.

A few questions about Form processing.?

2 Answers