Forum Moderators: phranque
To those of you who have registration forms, or information forms on your site....AND you have some form of validation on the form...
do you still get blank forms sent to the destinatino email?
im trying to figure out if someone is trying to hack my site through my form processing pages.
thanks
I would experiment with it to see when it happens.
NOW, i have just recently found that you can do directly to my "thanks.asp" page for the form, by typing in the direct URL.
for instance, [mysite.com...]
and you get the "thank you for your request, and executive will contact you shortly....blah blah...."
but what i have been getting recently is blank forms sent to my email that have no info on them?!?!?!
so somehow, someone is bypassing the validation and processing the forms with NULL values.....
how or why would someone go to all that trouble just to send me blank form requests...?
You cannot count on the validation being done, and you cannot count on the user not modifying the Javascript locally with browser extensions, command-line tools, pr simply bypassing the Javascript altogether, etc. etc.
Any and all form data MUST be validated by back-end software!
As to why somebody would do this, dunno. Maybe some kind of vulnerability testing.