CodeIgniter URLs

Question

Hi,

Any one of you who has worked on CI knows that it uses a segmental approach for the urls, eg.:

index.php/controller/function/params

Let's suppose I have put in place the following URL to submit the contact us form info:

index.php/contact/submit_contact

Now there is one thing that seems wrong. What if a bad guy sees the source code of my contact us page and looks at the action attribute of the form? He can simply copy-and-paste into a browser's address bar directly and my form will be submitted with empty values.

Another bad thing he can do and mostly likely will do is the CSFR cross-site-forgery.

How to avoid this problem.

Note: I know I need to validate my form against empty values and not submit it if fields are empty, but I am looking for a better generic solution to this problem.

Thanks

Answer 1

There is no better solution to this problem. Every web page you ever build should assume that all input coming from a user is hostile, and handle it accordingly.

The proper thing to do in this situation is attempt to validate the form, and when you discover that you have some incorrect or unacceptable values, re-output the form with error messages indicating the problems, and allow the user to fix it up before re-submitting. Code Igniter has an entire Form Validation module dedicated to this exact process.

Even if you use Javascript to validate a form and prevent it from submitting if it's not correct, you still need to repeat the validation on the server-side, since anyone can turn off Javascript before submitting a form full of bad values.

Answer 2

The CodeIgniter form validation stuff is easy to use and handles most common cases automatically.

Answer 3

One not-so-cool solution is to use CAPTCHA's. They will stop anyone from just submitting to your form action but it will also annoy your users.

http://codeigniter.com/wiki/captcha/