I use tools like Firebug pretty routinely, and often build SPA style dynamic forms where DOM manipulation with user inputs is routine. Are there any safeguards against a user inserting options into a select box using a tool like Firebug or any sort of javascript CLI?
As a simple example, consider this select box for you to choose whether you are married or unmarried (My actual select boxes have MANY more options, and are populated via AJAX from XML files. This will be important later.):
<select name="mstatus" id="mstatus">
<option value="" selected>Specify marital status</option>
<option value="Married">Married</option>
<option value="Single">Single</option>
</select>
Currently I can easily insert another option thusly (I have Mootools on the page):
$('mstatus').innerHTML+="<option value='Rebel'>I won't play by the rules</option>"
Now of course for this example, I can check server side whether the selected option is valid without too much grief. But generally I would have to compare the user submission to the original XML source for each select in order to confirm its validity.
Is there another way to ensure the integrity of returned values? Is this enough of a non issue for me to take user selection at face value? Is the best practice here really just to treat all select inputs as text inputs until you have confirmed they are selected from within their valid range of values?
Note: There is no danger of code injection, since all values entered are thoroughly vetted and are pretty inert by the time they get popped into the database.
No. The user has full control over the page, and therefore you should never trust what comes from there. Always perform complete a thorough validation on your server, and reject anything that doesn’t add up.
As far as the validation goes, you could just fetch the XML once and reference it repeatedly to check for validity, but aside from that there’s not really that much that can make it easier.