php - Input form with hidden field how to secure it -

after knew how secure upload image bypassing forms input fields upload unwanted files give example of 2 filed, 1 of them hidden.

sql table (id,name,jod,number)

create table `users` (   `id` bigint(20) unsigned not null auto_increment,   `name` varchar(255) default '0',   `job` varchar(255) default null,   `number` varchar(255) default null ) engine=myisam default charset=utf8; 

form code (support member edit own informations)

<form action="send.php" method="post" name="send" id="send">  <input type="text" name="name" id="name" value="john"/>  <input type="text" name="job" id="job" value="plumber"/>  <input type=hidden name="number" id="number" value="1234"/>  <input type="submit" name="submit" value="submit"/> </form> 

later there firefox extension can bypassing different input server-side bypassing checking , might case lot of damage here can stop whole process , makes able edit value of hidden table number such value="1" causing update information member have value number 1.

that extension working following, can fake input data before passed server side.

php code send.php

if(isset($_post['send'])){    $name   = mysql_real_escape_string($_post[name]); $job    = mysql_real_escape_string($_post[job]); $number = mysql_real_escape_string($_post[number]);  $sql= "update users set name='$name',job='$job' number='$number'";        mysql_query($sql) or die("query failed: $sql".mysql_error());  echo "update done";  } else {  echo "nothing update"; } 

the question how protect simple form such input form ? ~ thanks

this problems hurts cause made website free hacked :)

if user authorization not option in cause, try following techniques:

• set hidden field hash of number salted other information
• set hidden field number encrypted (possible salt increase security here also)

of course add steps when sending form html , validating post information, @ least harder attacker fake valid number on post. although not save if attacker knows encrypted/hashed number of different user unless salted information withing hidden field used wisely.