On 23 May 01 at 7:34, temporalassassin(at)yahoo.com wrote:

> This is a very simple solution to it.
> Have your Javascript set a hidden form field to a certain value if all
> validation goes ok.
> Then look for that value inside your CGI script. If its there, let it go
> through. If not, validate again, or return to the page.
> Hope it helps,
> Andrej

  First of all, thanks for your help !
  
  I know what you mean but unfortunately, I guess its not that simple. See : 
the user can download your page (save as), edit it, remove the scripts and 
submit the form again keeping the hidden field. It would be there but the 
form would not have been validated !

  So, guess it wouldn't solve it :-(

> --- JOSE ADRIANO BALTIERI <JABALTIE(at)iep-cen.unimep.br> wrote:
> > Hello List !
> > 
> > We have a lot of Javascripts, mostly to validate forms. These forms are 
> > submitted to our CGI programs. These CGI programs have to validate again
> > 
> > everything that had just been validated by Javascript. That's because
> > one can 
> > edit the page and remove the scripts from it, submitting an incorrect
> > form. 
> > Or more simply, just disable Javascript and submit the form (Netscape
> > allows 
> > that).
> > 
> > Then, if we were able to prevent or detect this situation, that is, be
> > sure 
> > that the form has been passed through our Javascript code, we would save
> > time 
> > (programming and machine) by avoiding redundant checks. Smaller CGI's
> > also 
> > would be a benefit. They would have to do only the other checks that 
> > Javascript couldn't do, probably those against databases.
> > 
> > Have heard about signed scripts but don't know neither what they mean
> > nor if 
> > they would solve this problem.
> > 
> > Have thought also about delivering/receiving tokens but, they're not
> > secure at 
> > all...
> > 
> > Thanks for any kind of help !
> > 
> > 
> >                                 Obrigado/Thanks a lot,
> > 
> >                                 Jose Adriano Baltieri
> >                                 Analista de Sistemas
> >                                 CPD - CENTRO
> >                                 UNIMEP - Universidade Metodista de
> > Piracicaba
> >                                 PIRACICABA - SP - BRASIL
> >                                 Fone : 055 0 XX 19 430-1858 (english
> > spoken)
> >                                 Fax  : 055 0 XX 19 430-1898 (cx postal
> 42778)
> 
> 
> __________________________________________________
> Do You Yahoo!?
> Yahoo! Auctions - buy the things you want at great prices
> http://auctions.yahoo.com/
> 

                                Obrigado/Thanks a lot,

                                Jose Adriano Baltieri
                                Analista de Sistemas
                                CPD - CENTRO
                                UNIMEP - Universidade Metodista de Piracicaba
                                PIRACICABA - SP - BRASIL
                                Fone : 055 0 XX 19 430-1858 (english spoken)
                                Fax  : 055 0 XX 19 430-1898 (cx postal 42778)

HWG: hwg-languages mailing list archives, maintained by Webmasters @ IWA