Forum Moderators: phranque

Message Too Old, No Replies

Forms

         

tonynoriega

10:34 pm on Nov 6, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I asked something similar before, but this is more general....

To those of you who have registration forms, or information forms on your site....AND you have some form of validation on the form...

do you still get blank forms sent to the destinatino email?

im trying to figure out if someone is trying to hack my site through my form processing pages.

thanks

eelixduppy

11:05 pm on Nov 6, 2006 (gmt 0)



Do you make sure that all the fields have content? Seems like an odd error.

I would experiment with it to see when it happens.

tonynoriega

11:11 pm on Nov 6, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



when i try to fill out the forms, and forget a required field, i get my javascript error that states you must fill in that field to process the request. on the email field, you must have the @ and .com, .net, .org....etc in that field.

NOW, i have just recently found that you can do directly to my "thanks.asp" page for the form, by typing in the direct URL.

for instance, [mysite.com...]

and you get the "thank you for your request, and executive will contact you shortly....blah blah...."

but what i have been getting recently is blank forms sent to my email that have no info on them?!?!?!

so somehow, someone is bypassing the validation and processing the forms with NULL values.....

how or why would someone go to all that trouble just to send me blank form requests...?

jtara

11:32 pm on Nov 6, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



You should consider any validation done by Javascript to be both "optional" and insecure. It is only there for the convenience of the user.

You cannot count on the validation being done, and you cannot count on the user not modifying the Javascript locally with browser extensions, command-line tools, pr simply bypassing the Javascript altogether, etc. etc.

Any and all form data MUST be validated by back-end software!

As to why somebody would do this, dunno. Maybe some kind of vulnerability testing.