0

What's the safest way to do a function update having a hidden html input containing the id of the data?

<input type="text" name="request_id" value="<?php echo $param_request['idx']?>" style="display: none;">

Form validation is already included in my code and that's for making sure that all fields are required.

But how do I prevent someone from altering the hidden field (id)? What do I need to add in my update function in the controller for better security?

Here is my function in the controller:

public function update()
{
    $this->load->library('form_validation');

    $form_data = $this->input->post();
    $idx = $this->input->post('request_id');
    $form_request_type = $this->input->post('request_type');
    $form_leave_start = $this->input->post('form-leave-start');
    $form_leave_end = $this->input->post('form-leave-end');
    $form_date_needed = $this->input->post('form-date-needed');
    $form_amount_needed = $this->input->post('form-amount-needed');
    $form_remarks = $this->input->post('redactor-textarea');
    $form_refer = $this->input->post('refer');
    $this->form_validation->set_data($form_data);
    $this->form_validation->set_rules('refer[]', 'refer', 'required');
    foreach ($form_data as $name=>$value) {
        if($name!='refer'){
            $this->form_validation->set_rules($name, $name, 'required');
        }
    }

    //Checkboxes
    $refer = json_encode($form_refer);

    //Not common contents
    $contents_info = json_encode(array(
        'leave_start_date' => $form_leave_start,
        'leave_end_date' => $form_leave_end,
        'date_needed' => $form_date_needed,
        'amount_needed' => $form_amount_needed,
        'remarks' => $form_remarks
    ));

    //Common contents
    $common_info = array(
        'requested_by_idx' => $this->session->userdata('member_index'),
        'request_type' => $form_request_type,
        'date_updated' => date("Y-m-d H:i:s A"),
        'contents' => $contents_info,
        'refer' => $refer,
        'status' => 'PENDING'
    );

    $log = array(
        'controller'=>'request',
        'method'=>'update',
        'item_idx'=>0,
        'member_idx'=>$this->session->userdata('member_index'),
        'member_category'=>$this->session->userdata('member_category')
    );

        $ret = $this->staffrequisition_model->updateItem($common_info, array('idx'=>$idx), $log);

        echo json_encode(array('ret'=>($ret == true) ? 1 : 0));

}

And also I loaded the update view using an anchor tag with the id send in the link:

<a href="<?php echo base_url();?>dashboard/staff/request/update_request_view/<?php echo $drafts['idx'];}?>" class="btn waves-effect waves-light btn-info update-button"><i class="fa fa-edit"></i> Update</a>

Receiving function:

public function update_request_view($idx)
{   
    $data = new stdClass;
    $data->param_menu = 'request';
    $type = $this->staffrequisition_model->getRequestType($idx);
    $typeLower = strtolower($string = str_replace(' ', '', $type));
    $commonContents = $this->staffrequisition_model->selectItem(array('idx'=> $idx));
    $uncommonContents = json_decode($commonContents->contents);
    $data->param_request = array_merge((array) $commonContents, (array) $uncommonContents);
    $data->param_request_type = $type;
    $data->param_refer = json_decode($data->param_request['refer']);

    $this->load->view('dashboard/staff/update_'.$typeLower.'_view', $data);
}
5
  • how do you prevent someone from altering the id on the hidden input? no you can't, once you expose it, they can see it, its just the way it is
    – Kevin
    Jul 12, 2018 at 1:17
  • so what should i do then? use an encrypted value of the id in the uri?
    – Azis
    Jul 12, 2018 at 1:19
  • paragonie.com/blog/2015/09/…
    – Kevin
    Jul 12, 2018 at 1:22
  • You could also use session data to hold the id value.
    – DFriend
    Jul 12, 2018 at 3:47
  • @DFriend how do i do it?
    – Azis
    Jul 12, 2018 at 3:49

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.