How to POST data to query in Form without any hidden-fields by PHP?

Question

My php query code

<?php 
  if (isset($_POST['btn_add'])) 
      {
          $query_insert = "INSERT INTO Calc_Tbl(id_Customer,Flname_Customer, )
          VALUES (N'$_POST[id_Hidden]', N'$_POST[flname_Hidden]' )";
          mysqli_query($db, $query_insert);
      }
?>

And my html form code to send data to above query

<form method="post" action="" >
    <input type="hidden" name="id_Hidden">
    <input type="hidden" name="flname_Hidden">
    <button type="submit" class="btn btn-danger" name="btn_add"></button>
</form>

Now you know the hidden fields can edit in Inspect Source in Web browsers by every body, How Can I send data in form to query in same page without any input fields as hiddens? How can use variables instead of input hidden fields?

Thank you

Answer 1

You're looking at the problem from the wrong perspective. The problem is not that the user can submit incorrect values. The problem is that your server-side code assumes that the values are correct.

the hidden fields can edit in Inspect Source in Web browsers by every body

Yes, this is true. Users can also craft any request they want to your server entirely outside of a web browser. It's fundamentally true that any client can send any request to your server at any time.

Rather than try to fight this, simply account for it. Ask yourself...

Why shouldn't User X be allowed to submit Value Y in this field?

As an example, perhaps that value/record belongs to a different user and this user shouldn't be able to edit other users' records. Then that's exactly what you should be validating server-side.

Expressed as pseudo-code:

if (!CurrentUser->canEdit($_POST[id_Hidden])) {
    die "You are not allowed to edit this record.";
}
// continue editing the record here

So then what is CurrentUser? That depends on how you track who the current user is. (Not included in the question.) However you track your logged-in users, refer to that information. And what is canEdit()? That depends on how you determine whether any given user is permitted to edit any given record. You'll have to write that logic.

Please note that the above is pseudo-code and you won't be able to just copy/paste it as-is and expect it to work. But hopefully it's illustrating the overall point. To put it simply:

When a user attempts to perform an action, first determine if the user is allowed to perform that action. If they are not, return an error. If they are, perform the action.

That's really all there is to it. Never implicitly trust information from the client. Always validate that the user is authorized to do what they're trying to do.

---

Side note, following all of the other advice posted in this question/answers so far...

Sessions are not needed for this. And relying on them for this will be extremely limiting and overly complex as your application needs grow and as application complexity grows.

There's absolutely nothing wrong with the client providing "hidden" values that the server uses. Indeed, this allows your services to be much more RESTful and much simpler to use and maintain. All you need to do is validate those values server-side before using them.

Answer 2

Put your variable data into $_SESSION global variables.
For that first thing to do is to start your sessions like this

<?php
session_start();
//now you have created $id and $flname somewhere in your code
//which you want to submit
$_SESSION['id']=$id;
$_SESSION['flname']=$flname;
?>

Rest of your form HTML code will remain as it is

The PHP program where your form is posted to will begin with

<?php
session_start();
$id=$_SESSION['id'];
$flname=$_SESSION['flname'];

If any other field were submitted, they will be inside $_POST, naturally
Until $_SESSION is destroyed using session_destroy;, your variables will be found in any other program you use subsequently.

Answer 3

you may use session for such fields..

No need to take hidden fields..

You can use session variables directly..

<?php 
          if (isset($_POST['btn_add'])) 
          {
              $query_insert = "INSERT INTO Calc_Tbl(id_Customer,Flname_Customer)
              VALUES ('".$_SESSION["id"]."','".$_SESSION["flname"]."')";
              mysqli_query($db, $query_insert);
          }
?>

Answer 4

See

You can encrypt this data and validate it on the server side, as it is said in one of the answers of that question, goes

As it was said in this link in some of the answers, you can encrypt the hidden fields in some way.

Answer 5

        With Ajax you can do like this :
var first = 'data1';
var second = 'data2';
    $("body").off("submit","#assignedUserForm").on("submit","#assignedUserForm",function(){
            $("#assignedUserForm [type='submit']").text('Loading...').prop('disabled', true);
            $('<input>').attr({
                type: 'hidden',
                name: 'id_Hidden',
                value: first 
            }).appendTo('#assignedUserForm');
            $('<input>').attr({
                type: 'hidden',
                name: 'flname_Hidden',
                value: second 
            }).appendTo('#assignedUserForm');
            var formData = new FormData(this);  
            $.ajax({
                url: 'url.php',
                type: 'POST',
                data: formData,
                contentType: false,
                cache: false,
                processData: false,
                success: function (response) {
                    $("#assignedUserForm [type='submit']").text('Submit').prop('disabled', false);

               }
            });
            return false;
        });