ansaurus

Question

Answer 1

+4 A:

Sinan Ünür 2010-03-09 16:47:20

Okay thank you! So it is not possible to see types.Would an alternative be to have a default radio with the same name to something that would trigger a failure, when I use the config file as a basis and make it default to a generic? Or do the hidden field way?

Tyug 2010-03-09 19:51:39

@Tyug: First, there are no types. You are confusing a user interface element with a type. Second, I have no idea what you mean with the sentence *Would an alternative be to have a default radio with the same name to something that would trigger a failure, when I use the config file as a basis and make it default to a generic?* Finally, don't trust information submitted to your CGI script to determine how the CGI script should validate inputs. **Maybe you should explain why you cannot use a known name for the radio group.**

Sinan Ünür 2010-03-09 20:08:03

Oh.. my bad for not being clear. I understand that there are no types.<br/>The second part is my thought of an alternative, which is to append another radio if there are none that is defaulted to. Thus guaranteeing that there will be a value in the radio group. The reason why I cannot know the name of the radio group is because they change depending on the config file chosen. Sometimes they might not even be there, and sometimes there may be more because due to the dynamic form. I also do not know which config they will use.

Tyug 2010-03-09 22:58:57

@Tyug I think it is time for you to formulate a coherent question collecting all these tidbits into something that fits together. What config file? Who are **they**? Think about these and write up a new question. You seem to have an X-Y problem: http://catb.org/~esr/faqs/smart-questions.html#explicit

Sinan Ünür 2010-03-09 23:25:06

Nope, I understood where I went wrong, and a better, more safe, way of avoiding the problem. Thanks to your security link. It was a helpful read.

Tyug 2010-03-10 14:09:39

Thank you very much for all your input!

Tyug 2010-03-10 14:10:08

Yep, my new design is much better and safer! Thanks a lot, seriously. I remembered why I had the config files, and it was for validation reasons and not just to render the form. Saved me a lot of pain from potential attacks. I'm glad this is my first CGI form.

Tyug 2010-03-12 16:14:44

@Tyug Your problem setup and solution makes a lot of sense now. Good luck.

Sinan Ünür 2010-03-12 17:15:16

Answer 2

+1 A:

Pass another hidden input field containing the name of the radiogroup, then just read

@values = $cgi->param($cgi->param("radiogroup_name")); // IIRC

dbemerlin 2010-03-09 16:52:54

And if the client suppresses this input field when posting to the server?

Oesor 2010-03-09 18:18:43

Oesor, how would the client suppress a hidden field?

Tyug 2010-03-09 19:45:33

@Tyug Whether a field is hidden is a user interface choice. I am afraid you do not know enough to know what you don't know when it comes to CGI programming. What happens in your script when someone types `http://example.com/shoot-myself-in-the-foot.pl?radiovar=yabadabadooo`?

Sinan Ünür 2010-03-09 20:09:51

nothing because i'm using post and not get.

Tyug 2010-03-09 22:41:01

Furthermore, I have protection against double submissions.

Tyug 2010-03-09 22:47:46

@Tyug I guess you have not heard of `wget` or `curl` or even Web Developer plugin for Firefox? You know what: Feel free to do whatever you want. But I have to point out that there is no good reason the server side script should not know the names of the inputs.

Sinan Ünür 2010-03-09 22:48:50

@Tyug => POST doesn't protect you, its just marginally harder to spoof

Eric Strom 2010-03-09 22:48:54

I have realized that... My mistake for going after what I thought would be a "simple" solution. After having a very problematic day yesterday. I guess this is what happens when someone gives me a project without real specifications.

Tyug 2010-03-10 14:05:00

ansaurus

tags:

views:

answers:

validating radiogroup with perl/cgi

related questions