ZEND PHP 5 Certification STUDY GUIDE

222 ” Security
Website Security
Website security refers to the security of the elements of a website through which
an attacker can interface with your application. These vulnerable points of entry include
forms and URLs, which are the most likely and easiest candidates for a potential
attack. Thus, it is important to focus on these elements and learn how to protect
against the improper use of your forms and URLs. In short, proper input filtering
and output escaping will mitigate most of these risks.
Spoofed Forms
A common method used by attackers is a spoofed form submission. There are various
ways to spoof forms, the easiest of which is to simply copy a target form and
execute it from a different location. Spoofing a form makes it possible for an attacker
to remove all client-side restrictions imposed upon the form in order to submit any
and all manner of data to your application. Consider the following form:
Street:
City:
State:
Pick a state...
Alabama
Alaska
Arizona
Zip:
Licensed to 482634 - Amber Barrow (itsadmin@deakin.edu.au)
This form uses the maxlength attribute to restrict the length of content entered into
the fields. There may also be some JavaScript validation that tests these restrictions