Re: use SESSION variable?

..oO(sheldonlg)

Tim Roberts wrote:

There are several ways to do this. A $_SESSION variable is one way, and in
many cases that's the most convenient. However, if you have a bunch of
pages with <form>s that succeed one another, it's also possible to pass
this kind of information as <input type=hidden> variables without the
overhead of a session.

To expand in what Tim wrote, here is what you would do in 2.php

<input type="hidden" value="<?php print $_POST['age']; ?>" >

Such improper use of form values is one of the main reasons for XSS
attacks. You almost always want to use htmlspecialchars() before the
output.

Micha
.

Relevant Pages

  • [VulnWatch] Re: New Web Vulnerability - Cross-Site Tracing
    ... then it could pose a significant threat. ... >and the involvement of three parties in XSS (attacker, victim, ... As specific issues in widely-deployed pieces of software become less common, attacks against application components will become more common. ... >But that should only affect how XSS is prioritized as a vulnerability ...
    (VulnWatch)
  • [Full-Disclosure] Re: New Web Vulnerability - Cross-Site Tracing
    ... then it could pose a significant threat. ... >and the involvement of three parties in XSS (attacker, victim, ... As specific issues in widely-deployed pieces of software become less common, attacks against application components will become more common. ... >But that should only affect how XSS is prioritized as a vulnerability ...
    (Full-Disclosure)
  • [Full-disclosure] XSS + XSRF/CSRF...
    ... Recently I've been testing some methods or semi-methods of securing web applications against ... XSRF/CSRF attacks (crypto tokens, POST instead of GET, Referer header validation, etc.). ... This is where XSS come into play. ...
    (Full-Disclosure)
  • Re: Disgusted-Aint America Great######
    ... the attacks on McCain from the website you linked to were true, ... personal vitriol on his website is way too prominent for you to cherry-pick ... people take from nuts like Sampley attacking both Dem and Repub candidates ... There might be sound reasons to mistrust John McCain, ...
    (rec.music.gdead)
  • Re: Sicko
    ... misunderstood the reason behind the 9/11 attacks, ... And not just the concept of him complaining. ... Whatever the misunderstood reasons for the attacks might be, ...
    (rec.arts.movies.current-films)