Comments on: PHP form input and Cross-Site attacks

by: chris

Wed, 17 Oct 2007 11:39:43 +0000

as a relative newbie to all of this, I have found this very interesting. So, excusing my ignorance, once the variables have been instantiated on the mail form, how would one verify this on submission?

by: ha.ckers.org security lab - Archive » Content restrictions and script keys

Mon, 26 Jun 2006 15:46:50 +0000

[…] Content restrictions was never designed to stop basic CSRF, unless you are talking about functions that could only be affected by JavaScript, which would inherantly be stopped. Brian’s comment that this would not help with reflected JS should be innaccurate, as any JavaScript would be affected (part of the problem was that it could end up killing valid JS on the page, which was something we were attempting to overcome in our first iteration of the idea by wrapping the possible offending output in tags to be parsed out by the browser as safe content). […]

by: Richard Lee

Sat, 17 Jun 2006 04:34:34 +0000

For those reading this article you might also want to read up on my post on mail-header injection, and another method spammers use to “hijack” your mail forms.

by: Cameron Manderson

Fri, 16 Jun 2006 02:39:50 +0000

Also you might want to unset the formId from your session when it is sumitted to the server. Also you will want to consider a strategy for your token_timestamp, which you can now use to make forms expire.