Question

I have a page that allows you to submit an article which is then placed into a database, to get to the submit page you have to be logged in (it checks session), but the processing script itself for storing into the database does not check if they are logged in, it only takes POST data from the submit page. Is this process secure? Is it possible for someone to force post information into processing.php and even if they are not logged in and not using the submit.php page (the processing script doesn’t check) and store information into the database via the processing script?

Answer 1

This is absolutely not secure. It is trivial to POST whatever data you want to wherever you want.

There are many tools for doing this. My favorite is Fiddler. One could also just make a page that posts data.

Bots post data all the time, looking for open mail relays.

This is not secure.