Cart
[Home] [By Thread] [By Date] [Recent Entries]
On Monday 24 February 2003 00:17, K. Ari Krupnikov wrote: [enforcing constraints by using HTML form dropdowns] > (*) as long as one doesn't construct the HTTP request manually -- I > wonder how many sites check that. Not enough! In my code I tend to enforce server-side form validation first, then throw in stuff in the HTML itself (even the cursed Javascript) if people demand it... You can sometimes have fun with shopping sites that use third party credit card payment systems by getting to the page that has the form that submits to the third party, saving it to disk, editing the hidden fields for 'amount' to a smaller number but leaving the order number intact, then submitting it. ABS -- A city is like a large, complex, rabbit - ARP
|
