javascript submit（）是否会停止php验证的必要性？

Question

If i use javascript submit() method to submit a form, the form will only be posted with javascript enabled, but i want make sure that is actually true. So my question is, do i need to do php validation because that might be some vulnerabilities i might not know about ? Is that enough ?

Answer 1

So my question is, do i need to do php validation because that might be some vulnerabilities i might not know about ?

Yes, you do. You can't blindly trust anything coming from the client, it can be entirely spoofed.

Off-the-cuff ways I could spoof what you're describing:

• A bookmarklet that changed form values and then did the submission
• Sending the HTTP request using curl or similar
• Using the JavaScript console to modify values before sending

I'm sure there are others.

Here's an example of just how easy the bookmarklet is:

javascript:(function(){var f=document.forms[0],e=f&&f.elements[0];if(e){e.value="My nefarious value";f.submit();}})();

That sets the value of the first element on the first form of the page to "My nefarious value" and submits the form.