I have created a form that contains the following within its <form> tag:
<input type="hidden" value="<?php echo $user_id ?>" name="author">
The problem I see here is that users can easily inspect element and change the value... and when doing so, affect how that value is processed in the form.
How do people make this type of form processing more secure so that users can't alter values?
The problem I see here is that users can easily inspect element and change the value... and when doing so, affect how that value is processed in the form.
Your application should not allow any such action without full server-side authorisation checks.
If the user is not supposed to be able to change the author value, you shouldn't even bother read the author value in the form submission, take the value you originally put into the form. If the user is supposed to have limited ability to change the author value (eg. only Administrator users can change the author), then check to see if the author value is allowed for the current user, and if it isn't then generate an error.
How do people make this type of form processing more secure so that users can't alter values?
The user is completely in control of what happens on the client-side, you can't make a browser take that control away from them. The security control must be on the server side.
(Some comments are suggesting encryption to protect a value given to a user, but this is much harder to get right than it looks. Applying an encryption function alone is no protection against tampering at all; to do that you need message signing and some connection between data in the signed message and the user/session and field purpose so the user can't just paste in an encrypted value they find elsewhere. Don't go this way until you really need to, the road is littered with corpses.)
<?php echo $user_id ?>
BTW you should use htmlspecialchars() when echoing any variable data into an HTML template otherwise you are vulnerable to HTML-injection (XSS).
I'm not the php crack but I would use something like
<input type="hidden" value="<?php echo encrypt($user_id, $secret) ?>" name="author"/>
where encrypt() should be a php encryption function (maybe How do you Encrypt and Decrypt a PHP String? will help...
On the server side you may use
$user_id = decrypt($POST["author"], $secret)
If conversion fails, somebody did something. To even harden your data, you could add some checksum field to cover the complete data set of hidden values. .NET ASP.NET does something similar with their data passed to the client as part of a form...
