HTML/CGI forms

Hi peeps,

Got a little problem at work.

Im currently writing the company website with online ordering capabilities. Im using perl/cgi to move the data from page to page. My problem is ive got a hypertext menu bar at the top of the screen for browsing the site, and ive got forms in the main body of the shop to pass data around.

Spot the problem yet?

The only way i can keep the data when changing page using the menu bar is to use submit buttons which obviously mess with the look of the site.

Does anyone know of a way of using Text beit hypertext or anyother way, to post form data?
I dont really want to create images for the menu bar, but it seems to be the only solution to date.

help with this would be great, my google searches have so far come to no satisfactory end.

-aX

I wonder how secure your site is going to be if you have problems with this. If i may suggest something, find out all you can on keeping state using session ids and read up on securing your site.

If you set up an image using and <img > tag anbd then set the onclick event of that image to be something like "javascript:document.forms[0].submit();" you can substritute forms[0] for the name of the form you are using. you can use this on any item you can set up to use the onclick event.

If you wanted some kind of validation you could put it in a function. but java script is definately one way of doing it.

Good luck, WaveRebel

Hi SirDice.

Security has been a concern, but i need a working site before i can think of securing it.

This is my first attempt at such a task, i've previous experience with html, but i've picked up perl and cgi within the last couple of weeks just to create this site.

-aX

SirDice a very good point,
anonymity X, you should look at using encypted cookies if you want secure sesion management, as get and post methods for posting forms can both be tampered with by the user as can unencyrpted cookies.

if you are using perl, then the CGI module provides stuff for working with cookies, but you will probably need towork out how to encrypt the fields. I expect there is another perl module to do this but my perl is not so good so I am afaiard I can't help you there.

Waverebel

ps you could encryt hidden fields in your forms as one way of securing them, a secret key would do as only your server would ever need to encode/decode it.

WaveRebel,

You say you can do this with images? could you not use this code with text instead, im using CSS to create a rollover effect on the text so it changes colour(would like to keep that).

-aX

it might be worth mentioning that the information im moving around only contians quantitys of products, not any personal information. the personal details part does not get parsed around everywhere and only within SSL.

i've looked into cookies and came to the conlusion that if visiters have cookies turned off, i have a non-working site!

-aX

I'm more than willing to help, but I don't quite understand what you are trying to achive. Is it possible you could give some more info about what you are trying to do. :)

But sending data via a form to be useded in next page i hear XXS alarm bells ringing! :eek:

SittingDuck

yes you can use it with text / hyperlinks. just put the code

<a herf="page.html" onclick="document.forms[0].submit();" >link text</a>

ps I hope this shows alright

you can use this inside any block level tag as far as I know, including <f o n t> <s t y l e> <t d>
<t a b l e> etc, beware the < d i v > tag only works in IE.

you can use it anywhere you are using you onmouseover() events.

Waverebel

I suggest you drop Perl/CGI and go with php, it's much easier to handle form and less chance of a mix up

ok,
First of all the data being moved around is non-personal information, it is only product numbers and quantities.

i have hypertext links at the top of the page, i want to be able to use these links to pass form data around. coz at the moment ive only found out how to do this using images or ugly looking buttons.

Im using CSS to style the text and would like to keep it that way.

-aX

looks like im gonna have to learn javascript, didn't really wonna have to do that.
makes you realise how limited html really is!

thanx for your help people.

where is the product information comming from in the first place? are you running a database?

SittingDuck

Quote:

---

Originally posted here by anonymityX
Hi SirDice.

Security has been a concern, but i need a working site before i can think of securing it.

This is my first attempt at such a task, i've previous experience with html, but i've picked up perl and cgi within the last couple of weeks just to create this site.

-aX

---

This is definitely the wrong way to do this. Security should be an issue right from the start or you will never get it right.

Security isn't easy, nor is it something that you can bolt onto a product after the fact.
-- Bruce Schneier.

theres no database, its all in cgi pages.

When they "add to basket" a part number(acting as a key) is assigned a value(the quantity), and from then on that information is stored in hidden forms, untill completion(i.e. either the order is completed or the page is closed).

I've chosen this way coz there really is'nt many products on this site.

-aX

SirDice,
I agree with you there, but i don't see the security risks in sending un-confidential information via post.
any personal information is contianed within SSL and then encrypted using pgp.

Quote:

---

Originally posted here by anonymityX
SirDice,
I agree with you there, but i don't see the security risks in sending un-confidential information via post.
any personal information is contianed within SSL and then encrypted using pgp.

---

Security risks? How about Cross Site Scripting and inserting unexpected user input so your app croaks (or even worse 'they' take over your app)?

I don't know about cross site scripting, would you be able to explain these risks to me. as i said before this is my first attempt.

I will be putting in checks to make sure the data im getting is what i want, can you recommend a good program that can check my scripts for possible holes?

-aX

ACK! Avoid JavaScript if you can. I'm serious ... use php. Look at the site you're on right now. Check out the address bar. See the little ".php" in there? PHP has an entire function class just for session handling. If coupled with SSL encryption, sessions CAN be (relatively) secure if done correctly. In my opinion the only correct way to do what you're trying to do is with encrypted sessions.

Here's a link to the sessions section on php.net:

http://www.php.net/manual/en/ref.session.php

Take special note of the section on security and sessions.

Just my $.02

Also, as soon as you can, switch them to a database structure. It sounds like they're concerened about cost since they're giving you so few resources. Try MySQL or PostgreSQL on for size. PHP interfaces great with both of these free database systems.

Quote:

---

Originally posted here by anonymityX
I don't know about cross site scripting, would you be able to explain these risks to me. as i said before this is my first attempt.

---

http://www.cgisecurity.com/articles/xss-faq.shtml

Quote:

---

I will be putting in checks to make sure the data im getting is what i want, can you recommend a good program that can check my scripts for possible holes?

-aX

---

http://www.wiretrip.net/rfp/p/doc.asp/i1/d6.htm
http://www.wiretrip.net/rfp/p/doc.asp/i1/d21.htm

Thanks guys,

I hadn't given security enough thought until reading the links by SirDice, u've saved me from my own ignorance! lol.
But seriously thanx alot, these links will keep me busy for the rest of the day and hopefully i'll end up with a secure site!

thanx again.....

-aX

Im sorry but SSL is only part of the anwser. All an SSL connection does is to prevent someone from sniffing the traffic. It does not stop someone from tricking the web server into giving it your details!

The topic of web security is massive, I could spend all day writing about it. But to start you off have a very very good read of www.owasp.org To me it's the best web app security information site going

anonymityX because of the task you are trying to do I would use a language with a database at the backend like php, asp, jsp, coldfusion or even perl/cgi. But using a database to store your information will make life alot easier for self when it comes to thinks like, storing customer information, traking what they bought, stoing your products and allowing for future growth of the site. But again this will bring new security problems.

But like I said I would stongly suggest you read www.owasp.org as they cover all aspects in web security and wont try to sell you any thing.

SittingDuck

MY 100th POST!!!!!!!!!!!!!!!!!!!!

SittingDuck