August 22nd, 2007, 02:59 PM
|
|
Registered User
|
|
Join Date: Aug 2007
Posts: 1
Time spent in forums: 9 m 35 sec
Reputation Power: 0
|
|
Quote: | Originally Posted by Code Walkers We build web applications to do useful things for us, but unfortunately there are those that attempt to cause our creations to do something we never intended them to do.
Read the full article here:
For more discussion go here: |
the article gives a fix example of
Quote:
PHP Code:
if($_SESSION[‘token'] != $_GET[‘sitetoken']) {
echo "Not a valid request!"; exit;
}
update_email();
echo "Your email address has been updated.";
?>
|
why would you want the default case to be approve the change? shouldn't you be evaluating the request to see if it matches, if it does then you approve, in every other circumstance you deny? While here the difference may be minor, overall it will help ensure you didn't make a mistake somewhere else and provide an opportunity for the code to reach that point unexpectedly
|
Codewalkers Forums Sponsor:
Del.icio.us
Digg
Google
Spurl
Blink
Furl
Simpy
Y! MyWeb
Linear Mode
