So far, thanks for the many contributions to the issue.
       
       We all know that it is pretty much easier to do these validations 
using JavaScript. 

       A lot of time is spent later, to program the same code within CGI's. 
Let's not even mention the possibility of mistakes here. Such as things that 
are validated on one side and not in the other. What about future 
maintenances ?
     
       The point is : if we find out a secure way to do it, we would save 
us a lot of time and, take Javascript to a higher degree ...

       Another idea : having the script coming from an external SRC and, this 
url would have httpS. Would it work ? 


On 23 May 01 at 8:20, lcoats(at)gte.net wrote:

> 
> 
> Andrej Kostresevic wrote:
> 
> > This is a very simple solution to it.
> > Have your Javascript set a hidden form field to a certain value if all
> > validation goes ok.
> > Then look for that value inside your CGI script. If its there, let it go
> > through. If not, validate again, or return to the page.
> > Hope it helps,
> > Andrej
> 
> That's a good way to determine whether the user had javascript enabled or not
> - I'll remember that.
> 
> However, it still doesn't solve the problem of a user being able to save your
> HTML page with the form and editing it. He could remove all of the validation
> scripting and hardcode the hidden field to the value that you're using to
> indicate that validation was done. He can then submit the form from his
> modified form - and can slip anything in that he wants!
> 
> Larry Coats
> 
> 

                                Obrigado/Thanks a lot,

                                Jose Adriano Baltieri
                                Analista de Sistemas
                                CPD - CENTRO
                                UNIMEP - Universidade Metodista de Piracicaba
                                PIRACICABA - SP - BRASIL
                                Fone : 055 0 XX 19 430-1858 (english spoken)
                                Fax  : 055 0 XX 19 430-1898 (cx postal 42778)

HWG: hwg-languages mailing list archives, maintained by Webmasters @ IWA