Closed. This question is opinion-based. It is not currently accepting answers.
Want to improve this question? Update the question so it can be answered with facts and citations by editing this post.
Closed 9 years ago.
Improve this question
I am building a website and I have a questions with forms on login/registration page. I have a few standard javascript validations on the login page. My questions is should I just disable the login button if javascript is disabled or should I keep PHP validations on the server side code?
Which is a better approach in terms of security? I am planning to keep login/registration button disabled and only enable it by javascript. That way I can avoid writing PHP side validation of the same JavaScript that is already there. Is it a secure way of doing it?
Thanks
Overall, use PHP. Javascript can be easily fooled and/or turned off entirely. At that point your server gets supplied with whatever Mr Malicious End User wants you to have, and you won't be stopping them.
Use PHP for validation, and if you want it to look fancy, put javascript on top. But ALWAYS server-side validate.
As a general rule of thumb, anything relating to security or prevention of particular user behaviors, don't rely on javascript or CSS to stop something from happening on a page. Since scripts and css can be overridden or disabled in the browser, you'll have no protection against that behavior if they do so.
Server side is the correct place for implementing preventative security precautions.
Also, note that doing both is very nice for user experience, but server side is the only definitive place for preventing unwanted data making it through.
Every client-side validation MUST be replicated server-side to ensure security. Your client side scripts can be easily replaced by a malicious user in order to bypass your validation completely and buttons can be re-enabled fairly easily with web debugging tools.
However, it is sometimes wanted for user convenience to also include client-side validation. In which case, you have to validate both server-side (PHP) and client-side (Javascript).
PHP side validation is better .
Client side validation is NOT secure because it can easily be hacked. It is for user convenience only. For example, in response to client-side validation, the user can fix mistakes before the form is submitted. That saves the user time, and they appreciate your site.
Security validation must take place on the server
You must validate your data on the server and parse the answers of it with Javascript. Only use Javascript to add/remove HTML content and create better user interfaces.
Always take this into account: What happens if the user disables Javascript in his/her browser?
Related
Closed. This question needs to be more focused. It is not currently accepting answers.
Want to improve this question? Update the question so it focuses on one problem only by editing this post.
Closed 5 years ago.
Improve this question
I have a very limited understanding of PHP, as well as the internet for that matter. I'm wondering if someone could simply send a POST request to my PHP script (assuming its public). Wouldn't that have the potential to mess up my entire script?
Answer: YES.
The end.
I think this question comes from some security concerns that are not being worded.
First off, know you can check the request method (a.k.a HTTP verb) with $_SERVER['REQUEST_METHOD'].
Second, you can send HTTP request from the browser, or from other software with whatever request method, to whatever public server (read: reachable on the network). And yes, you can handle other things aside from GET and POST in PHP.
I have found the browser extension "Requestly" useful for testing.
You might be interested in Cross-Site Request Forgery and Cross-Site Scripting.
Let us talk mitigation...
It should be evident... but: validate all input. Do not trust that the input comes from a well intended user of your own site.
After validation, it could be necesary to have a sanitation step. For example, if you are going to display the values you got from a request to your users, sanitize the input so it does not contain HTML code. By doing so, you are preventing the attacker to inject potentially dangerous code in your page (being the classic example, injecting javascript).
You probably know this already also, however: Use prepared statements. If you are sending the data you got from a request to the database, using prepared statements will protect you from SQL injection.
Yes, I know the question is not about javascript or SQL injection. However Injection reminds the most common vulnerability according to OWASP TOP 10 and people who wonder if third party can make requests to their page is the kind of people who needs to be told this.
Alright, next up, you need to know if the request comes from an authenticated user. Again, you are probably doing this already, use sessions. What you might not know is that PHP session cookie is not HTTP only by default, meaning that it could be stolen on the client (see Session Hijacking). To fix that use ini_set('session.cookie_httponly', 1);.
Now, of course, the cookie could be stolen from a Man In the Middle attack, which brings me to: use HTTPS. You can get an free SSL certificate to set up HTTPS in your hosting from Let's Encrypt, if you are new to this, I suggest using ZeroSSL which will make it easy to get a certificate and uses Let's Encrypt behind the scenes.
Finally, there are scenarios where you need to make sure the request does not come from a malicius party and you cannot depend on a session being open. In this situation you need to issue a token associated with an specific action, and only allow the action to proceed if the token is presented... for example, if the user wants to recover access (forgot password) you can send a link with a token to their email account, and if the email is presented (and optionally if a captcha is resolved) you allow the user to set a new password.
I hope I do not need to tell you How NOT to Store Passwords!.
For more information see OWASP Cross-Site Request Forgery Prevention Cheat Sheet.
I'm wondering if someone could simply send a POST request to my PHP script (assuming its public).
Yes, though not via XHR/fetch from a modern browser if you haven't allowed CORS. (This doesn't stop a regular form on another web page posting to your script.)
Wouldn't that have the potential to mess up my entire script?
How so? You're responsible for properly handling anything posted to you.
This question already has an answer here:
Is my JavaScript validating enough?
(1 answer)
Closed 9 years ago.
So up to now i got my client side validation ready, But what if javascript disabled?...
I was thinking what can be the best method to make sure the data i get is valid:
For start i can also test the data on the server side but than what is the point with all the javascript validation.
HTML 5 got some validation features but limited browser support.
I was thinking about something with Ajax but can't put my finger for ajax solution yet.
So i will be very thankful to get some suggestions for solution when javascript off.
Never trust user input.
Never trust user input.
Never trust user input.
Never trust javascript validation, which can be tampered with very easily since it executes on the browser. Consider it is part of the user input.
Never trust user input.
Server-side validation is always mandatory, whether there is javascript validation or not. Other than that, Ajax is just a funky name for dynamic javascript calls to URL's. No Javascript, no Ajax.
There is nothing else I can think of, besides HTML5 validation (which must not be relied upon either, as it can be circumvented as easily as Javascript validation).
Even if JavaScript is turned on, it's still perfectly possible to manipulate a form to post information that you might not be expecting on the server-side. Server-side validation is always needed for data storage and manipulation.
Yes, you should always have BOTH validation client side (javascript) and server side (business object in your language of choice).
You absolutely cannot trust all users to use/leave client side alone.
Client side validation is to help the user stay sane so they are not posting-erring, try again, post-erring, try again. And you cut traffic to your server/objects as well. Everyone likes that.
But you NEED to have your server side do a final validation if you are serious about validation. If you ever can only pick one or the other (and if a client has js disabled...) you pick server side.
If you want a slight lessening of what seems like redundant validation, have your form ajax post/call to a validator that calls your BUSINESS LOGIC rules on the server but then when the final post occurs, it needs to run through the BUSINESS LOGIC rules again before you commit.
Please remember this mantra:
JavaScript validation is good for the user, but Server validation is good for security.
And this one too:
User data is always evil.
In other words, always perform server validation, because at the end of the day you are dealing with user data that may have been tampered with.
This question already has answers here:
Closed 10 years ago.
Possible Duplicate:
Why is client-side validation not enough?
What is the purpose of using the both validations at the same time? Because it's extra burden on the server for validating the form inputs in php if javascript validation is successful. Can not we use a flag and set or unset its value depending upon whether javascript validation is successful or not? And if the flag value is set, we will skip the php validation. Is it not possible? If it's not possible can you explain with a valid real life example? Or can a user modify the value of the flag even if we pass it in header?
Waiting for some logical answers.
Thank you.
Validating with JavaScript saves you a trip to the server, and creates a nice responsive user experience.
Validating with PHP is necessary so you don't get broken data, or worse (the user could disable JavaScript or post data to your PHP application in a number of ways).
JavaScript can be disabled by the user. It can also be manipulated because it is client side.
One thing to always keep in mind, never trust the users input. Even if you trust the users, or if the website is limited to a very small known to you audience.
So always keep server side validation.
Client side validation is for usability, so I would recommend you keep that too.
The purpose quite simply is the safety.
Javascript validation is happening on the client side - in the users browser. There are no problems to disable or edit the validation to my liking by using a tool like firebug, for example, or to disable it at all by disabling javascript in my browser.
PHP validation, on the other hand, is done on the server side and the user can't interfere with that.
To sum it up, and how I like to think about it - Javascript validation is for the ease of use for the client, PHP is for actual safety.
You can never trust user input. JavaScript is a utility for improving user experience, not your first line of defense against malicious user behavior. JavaScript itself can be used to bypass all JavaScript validations; all someone has to do is type this command in console:
document.forms[0].submit();
Now I am not sure what is with the idea of using flags. But it just as easy for someone to "set" the flag manually if he/she can JavaScript validation.
And if you think server side validation causes burden on the server, you're being ignorant (or lazy, perhaps).
Client side validation is primarily for user-experience and basic-validation.
While writing server side code, you should write validation to ensure security and to make sure the requests are not tampered in between.
As you might know, browsers allow the user to disable javascript. In such a case, client side validation code will not be executed. If there is no server side validation, this will create inconsistency in your application.
For example, if there is an input text field for which you application is expecting an integer value and the user inputs a non-integer value, your application is bound to misbehave and if you are using a database, it will throw some error
To strengthen a point the other answers may have implicated: Not only is it possible to bypass JavaScript in a browser, but it is possible to send data to your server without even visiting your website, if an attacker analyses the requests send to and from your website.
This can be done either by a tool that manipulates the GET / POST requests (thus even using a valid session) or a tool that builds its own requests.
JavaScript validation is to help your regular users to enter well formed data, server-side validation protects your server / your data integrity
I have built a small app using javascript. I am using javascript for form validation and i am wondering if by using the "no script" tag if this will protect me against people passing non-clean data into my mysql db? I will deny access to the application to anyone who has it turned off. Is this a secure method or do i have to also do php form validation on top of the js validation?
If not, can someone advise me on what is the best way to ensure that the data submitted to my db is not harmful and clean. Id like to do this using javascipt if possible and not layer it with php but if i have to i will as long as my app is secure.
I know i must do some php cleaning such as htmlentities but want to avoid doing form validation with php.
Thanks.
No, you can never trust the client-side to validate. You must always validate server-side. Client-side validation can improve the user experience, but it gives no security benefit.
As a general rule, you never want to rely on client-side code (javascript in this case) to validate data. The client has full control over anything you would put in javascript, and so it would be pretty easy to bypass. Always validate on the server where you have full control of what is happening.
No, you always need to do serverside validation. You can alter JS even when it's turned on (in Chrome for example, you can just pause script loading, edit the JS then run it), therefore it wouldn't even matter if it's on or not.
This is a good starting point: http://net.tutsplus.com/tutorials/html-css-techniques/build-a-neat-html5-powered-contact-form/ (towards the bottom is the validation examples)
Javascript protection is just "visual". Anyone can bypass it and insert any data he/she wants.
You should always validate user-submitted data server-side.
Basically you can start with mysql_real_escape_string() for preventing mysql injection, and do some tag stripping if you are going to display the inputted data back.
I really like the idea of validating forms client-side before doing so server-side. If the client's validation passes, I can use Javascript to submit the form.
However, I have heard that some specialized browser, like browsers for the visually impaired, don't support Javascript. Therefore, those users won't be able to submit my forms. Should I therefore avoid what I just thought of doing, or is it alright?
EDIT: (In response to answers): I guess I didn't explain that, but I was planning on doing server-side validation in addition to client-side. Sorry!
Thanks
Javascript is a nice touch to validation. It lets the user know right away that something is wrong, plus it minimises potential calls to the database.
If there are browsers out there that disable javascript for accessibility reasons, you shouldn't worry to much. That's what the server-side checking helps with.
So you should use both, and test with javascript turned on or off. NEVER use javascript as a sole validator - you could just turn javascript off in your browser and the POST data would go through!
You should do both client-side validation and server-side validation. Everything you catch with client-side validation is an opportunity to improve the user experience for your users and tell them exactly what is missing or wrong before they submit the form. If, for any reason, javascript is not enabled, you will still validate on the server (as you always should) and can return errors through the form response from the server if you have to.
So, it's always a good idea to use client-side validation if available.
Is client-side validation smart? Yes, clean input is better for performance than input that will error out.
Great UX? Yes, it's important for a user to get quick, relevant feedback.
Safe? No. Not at all. Hackers don't use your interface to hack your site.
More and more browsers can be site-selective about running JS.
Lastly, if you are concerned about equal access, your best bet is to build accessible versions of the site.
Client side validation often improves user experience, as the user can immediately see whether his data is valid or not.
If it is some simple validation, like pattern matching or length checking for passwords, definitely do it. But of course it is not a substitution for server side validation, it is not a security means in any way. Never trust user input.
Integrate the client side validation in an unobtrusive way, so that form submission still works if JS is turned off.
"Both And" is the answer. Validate client side as a convenience and as a way to better the user experience, but you should always validate server side.
Browsers without JavaScript won't execute the JavaScript at all, so they will still be able to submit your form. Don't worry.
Client side validation is done by interceptin the normal submit event and return true or false based on whether the form is valid. In this way, when javascript is not enabled, the submission is not intercepted and proceeds as normal.
It is one of the easiest things to degrade gracefully, fortunately :)
Not sure we can say it's smart to handle form "control" before submitting : this is "only" client comfort, as these controls... are just not valid from the security standpoint. So this is adding coding efforts for no added value from the security prospective. But this is adding effort for client comfort. And THIS is smart.
The simple way :
No client-side control at all, only server side. No need that js is enabled on the client-side.
This is the point that shall be always enabled and full security valid.
The intermediate way:
Implementing the simple way and adding some javascript "controls" on top, "hand coded" or using js librairies. This is the fastidious way as this is adding a layer on top of the existing server core code, and generally means some server-side code changes or refactoring. So this is the worst way according to me. But this is a good way to learn and understand the client-server exchanges. Painful but useful.
The best way:
Base all your efforts on server-side validation but make sure, from the coding starting point, to be able to embed also the "nice to have", eg. the client-side nice "controls". Which means you have to think of your code architecture before starting writing any line. How to do that ? use Ajax coded forms on the server side. Which suggests the way of coding ideally with specific php form classes. For example, ZendFramework is providing such kind of possibilities using either dojo or jQuery.
Its always better to have "Cleaner" data passed into the server.
Prevents errors and malicous data.