Javascript protection for html form not working

Question

I'm protecting my html form using javascript because my users can just change the input values and I want to check if the input value is equal to the random generated number. I'm using an if/else statement and the if else statement isn't working.

var pokeid = '+res.id+'; //generates random id
var html = '';
html += '<form id="myForm" action="myurl.net" method="post">';
html += '    <input type="hidden" id="goid" name="goid" value="'+res.id+'" >';
html += '    <input type="hidden" name="level" value="'+res.level+'" />';
html += '    <input value="Battle!" class="button" onclick="myFunction()" />';

</script>

<script type= "text/javascript">

function myFunction()
{

if (pokeid != document.getElementById("goid").value; ) {

window.location = '("http://www.myurl.net/index.php")';

}else{
document.getElementById("myForm").submit();

}

}

</script>

Have you not noticed the syntax error reported for that stray semicolon? — Pointy
– Pointy, Commented May 13, 2014 at 21:51
You do realise that a user can just as easily set pokeid = 12345 in their console, right? — Niet the Dark Absol
– Niet the Dark Absol, Commented May 13, 2014 at 21:51

Niet the Dark Absol · Accepted Answer · 2014-05-13 21:52:22Z

2

There is NO security in JavaScript. All validation must be done on the server. Nothing else can be trusted.

That aside, you have a stray semicolon in the if statement, and your window.location assignment should just be a URL. Not those weird parentheses, quotes... things.

answered May 13, 2014 at 21:52

Niet the Dark Absol

326k86 gold badges480 silver badges604 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Joseph Casey · Accepted Answer · 2014-05-13 21:57:06Z

1

This is a very relevant article that you should read before you proceed with any client side verification.

"Do not rely on client side validation to validate the user input. Client side validation is great for helping the user input correct data. But a malicious user will not use this and could bypass the client side validation. Client side validate is should never be considered as a security fix. Using javascript to validate input should not be used. As you can see javascript is very easy to change and modify on any html page."

Src: "http://www.testingsecurity.com/how-to-test/injection-vulnerabilities/Javascript-Injection"

answered May 13, 2014 at 21:57

Joseph Casey

1,3031 gold badge14 silver badges35 bronze badges

Collectives™ on Stack Overflow

Javascript protection for html form not working

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related