I am trying to make a POST request with PHP. I am trying to submit a users name along with a generated hash. The following is the code I currently have:
<?php
if( isset($_POST["name"]) && crypt($_POST["name"],'saltgoeshere') == $_POST["hash"] )
{
echo "Name is ". $_POST['name']. "<br />";
exit();
}
else if( isset($_POST["name"]) && crypt($_POST["name"],'saltgoeshere') != $_POST["hash"] ) {echo "Invalid/Tampered Request?"; exit();}
?>
<html>
<body>
<form action="<?php $_PHP_SELF ?>" method="POST">
Name: <input type="text" name="name" value="" />
Password: <input type="hidden" name="hash" value="<?php echo crypt($name,"saltgoeshere");?>" />
<input type="submit" />
</form>
</body>
</html>
The users submits their name and the script creates a hash based on their input and creates a POST request with both the name and hash. The script then looks at the post request and checks if the hash that was submitted, matches the actual hash.
The problem that I currently have is generating the hash based on the users input because PHP is a Preprocessor.
Would making an AJAX request fix this issue?
Edit: I am trying to make sure the user has not tamped with the data when it has been submitted.
I am trying to make sure the user has not tamped with the data when it has been submitted.
To be very blunt: this is a very stupid reason. The user is entering data into a form and submitting it to you. They are already "tampering" with the data. It doesn't make any sense to want to sign this data in any way. Even if the "problem" of PHP being a "pre-processor" would not exist, how would this work? PHP would take the data input by the user, sign it, then submit it to itself and check the signature? You can skip this whole process and just take the input of the user, that'll have the same outcome.
You could do the signing in Javascript, but this is equally nonsense. You're providing the Javascript code which can produce a valid signature to the client... what's stopping anyone from "tampering" with the data and then producing a valid signature for it?
Something that would make sense:
hidden
form element and you want to check that the user did not alter this value while it was going server→client→server; in this case you can sign it with a hash and a secret which only the server knows and verify it this way. The key here is that there's a secret component on the server that the client doesn't have and can't fake.