Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I have had a look at this link: https://www.owasp.org/index.php/Input_Validation_Cheat_Sheet
which discuss the use of whitelists on drop down menus.
What I dont get is why would you use a whitelist on a list of options when that is all there is to choose from?
I understand why you would use it on user input like typing in your name etc but I dont get why you would use it on options as the user is not physically typing something in.
Or have I just read this wrong?
You are assuming that they will use your form to post to the form processor, but that is not necessarily the case.
Apart from that it is easy to modify the values from the dropdown using for example firebug and post the form after that.