[
Lists Home |
Date Index |
Thread Index
]
On Monday 24 February 2003 00:17, K. Ari Krupnikov wrote:
[enforcing constraints by using HTML form dropdowns]
> (*) as long as one doesn't construct the HTTP request manually -- I
> wonder how many sites check that.
Not enough! In my code I tend to enforce server-side form validation first,
then throw in stuff in the HTML itself (even the cursed Javascript) if people
demand it...
You can sometimes have fun with shopping sites that use third party credit
card payment systems by getting to the page that has the form that submits to
the third party, saving it to disk, editing the hidden fields for 'amount' to
a smaller number but leaving the order number intact, then submitting it.
ABS
--
A city is like a large, complex, rabbit
- ARP
|
