Making Random field in HTML Form

Question

I have the following code to generate a random string

function generateRandomString($length = 10) {
  $characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
  $randomString = '';
  for ($i = 0; $i < $length; $i++) {
    $randomString .= $characters[rand(0, strlen($characters) - 1)];
  }
  return $randomString;
}
$s= generateRandomString();

And have an HTML Form in which the name field gets the random string in that form

<input type="text" maxlength="10" name="<?php echo $s;?>" class="tracer-number-input"/>

Now how do I make sure to get POST of that Random string when I use this

$num = $_POST[$s];

It does not work as expected because when I click the submit button of the HTML form, the page reloads and the random string is changed so the POST form does not got the previous random value. That breaks my logic.

The main motive is to make a HTML form in which the name of the input field is random and the post field will also get that random string.

I want to prevent the autoscript to make submission as every time this generate different POST field and then the autoscript is unable to process even if I have not added a captcha

Use random string to hidden field eg: <input type="hidden" name="tracer-number-input" value="<?php echo $s;?>"/> — Tamil Selvan C
– Tamil Selvan C, Commented Sep 21, 2013 at 4:46
But i want that user will input data in that text input field. and if i hide this then How the user also input.I want to take input from user in that field — user2710639
– user2710639, Commented Sep 21, 2013 at 4:55
Save the random string in a hidden field too or use the session — mplungjan
– mplungjan, Commented Sep 21, 2013 at 4:58
You can try DynamicFormFields for hiding real form fields names in forms. — Shub
– Shub, Commented Apr 26, 2015 at 1:49

DACrosby · Accepted Answer · 2013-09-21 05:06:07Z

3

How about set the value to a hidden field.

// If $_POST["random"] is set, set its value to $s, else set $s to a random string
$s = isset($_POST["random"]) ? $_POST["random"] : generateRandomString();

<input type="hidden" name="random" value="<?php echo $s; ?>" />
<input type="text" name="<?php echo $s; ?>" value="whatever user types"/>

answered Sep 21, 2013 at 5:06

DACrosby

11.5k3 gold badges42 silver badges52 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Zack Newsham · Accepted Answer · 2013-09-27 16:31:09Z

1

You have two options:

Store the random string in the $_SESSION variable and on POST, get the field name from there.
Alternatively, if all you are aiming to do is give the post a different name for whatever reason and you know the names of all your other $_POST fields, you can loop over each field and find one that doesn't match. However, that will remove any "security" you had hoped to achieve.

edited Sep 27, 2013 at 16:31

answered Sep 21, 2013 at 5:03

Zack Newsham

3,0022 gold badges27 silver badges45 bronze badges

Comments

Lie Ryan · Accepted Answer · 2013-09-21 05:48:05Z

You could encrypt your field names in a way that only you could decrypt:

<? 
    $MY_SECRET_KEY = ...; // this is a constant with random string, stored somewhere safe and not disclosed to anyone
    $iv = mcrypt_create_iv(...);
?>
<input name="iv" type="hidden" value="<?= $iv ?>" >
<input name="<?= base64_encode(mcrypt_encrypt(
                           MCRYPT_RIJNDAEL_128, 
                           $MY_SECRET_KEY,
                           $plain_field_name, 
                           MCRYPT_MODE_CBC, 
                           $iv)); 
?>" value="...">

While decrypting the form:

$iv = $_POST['iv'];
for ($_POST as $encrypted_field_name => $value) {
    if ($encrypted_field_name == 'iv') continue;
    $plain_field_name = mcrypt_decrypt(
        MCRYPT_RIJNDAEL_128,
        $MY_SECRET_KEY,
        base64_decode($encrypted_field_name), 
        MCRYPT_MODE_CBC, 
        $iv
    );
    ....
}

However, note that there are some form auto-fillers that uses the form label or input order instead of the form name; I don't think there's any way to completely defeat those type of form fillers while still making your form usable for actual users; the most you can do is to make sure that your labels and input fields cannot be matched up easily, this can be done using CSS3 flexbox or javascript to reorder the input fields in addition to encrypting the field names. For an automatic form filler to defeat this, they would have to understand flexbox or run the script. I think that would have been sufficient to prevent most script kiddies.

Collectives™ on Stack Overflow

Making Random field in HTML Form

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related