How do I secure PHP forms?

Question

I don't run a mission critical web site so I'm not looking for an industrial strength solution. However I would like to protect against basic attacks such as someone mocking up a false page on the hard disk and attempting to gain unauthorized access. Are there any standard techniques to ensure that form submission is only accepted from legitimate uses?

Answer 1

A few techniques come close:

• Produce a form key for every form. The key would relate to a database record, and something else unique about the page view (the userID, a cookie, etc.). A form cannot be posted if the form key does not match for that user/cookie. The key is used only once, preventing an automated tool from posting again using a stolen key (for that user).
• The form key can also be a shared-secret hash: the PHP generating the form can hash the cookie and userID, for example, something you can verify when the form is posted.
• You can add a captcha, requiring a user to verify.
• You can also limit the number of posts from that user/cookie (throttling), which can prevent certain forms of automated abuse.

You can't guarantee that the form isn't posted from disk, but you can limit how easily it is automated.

Answer 2

You can't. There's no reliable way to distinguish between an HTTP request generated from a user on your page, or a malicious user with their own web-page.

Just use a proper password authentication approach, and no-one will be able to break anything unless they know the password (regardless of where the HTTP requests are coming from). Once you have reliable server-side authentication, you don't need to waste time jumping through non-robust hoops worrying about this scenario.

Answer 3

You should not create a login-system yourself because it is difficult to get it right(security). You should NOT store the passwords(in any form whatsoever) of your users on your site(dangerous) => Take for example lifehacker.com which got compromised(my account too :(). You should use something like lightopenid(as stackoverflow also uses openid) for your authentication.

The remaining forms you have on your site should have the following protection(at least):

• CSRF protection: This link explains thorougly what CSRF is and even more important how to protect against CSRF
• Use http-only cookies: http-only sessions, http-only cookies
• Protect against XSS using filter.
• Use PDO prepared statement to protect youself against SQL-injection

Answer 4

i also recommend:

1. Save the IP of the computer that sends the form (to block it from the server if it.s annoying)
2. Use CAPTCHA when required, to avoid robots...
3. Send users to another page when the info is loaded, so the POST data won't be retrieved when you refresh the page.

Answer 5

Proper validation of form data is important to protect your form from hackers and spammers!

• Strip unnecessary characters (extra space, tab, newline) from the user input data (with the PHP trim() function)
• Remove backslashes () from the user input data (with the PHP stripslashes() function)

for more detail, you can refer to Form Validation