I have index.php and I have a login form:
<form method=post action="login.php" id="login">
<input type="text" size="16" maxlength="30" name="login" id="login_user" />
<input type="password" name="pass" id="login_pass"/>
<input name="msubmit" type="submit" value="Login" />
</form>
How can I make sure that the form gets processed through a secure line?
Do I have to add https://?
<form method=post action="https://test.com/login.php" id="login"
Any ideas?
Thanks.
Yes, the best way is to specify https:
<form method="post" action="https://domain.com/login.php" id="login">
<input type="text" size="16" maxlength="30" name="login" id="login_user" />
<input type="password" name="pass" id="login_pass" />
<input name="msubmit" type="submit" value="Login" />
</form>
Even if index.php was served through a secure channel, it is good practice to explicitly specify https on the post action because this is the request which sends sensitive data over the wire. But it is also recommended to have index.php served through https only.
Use https protocol. Also treat all the parameters as tainted - and get the PHP script to process them in a responsible fashion.
*I.e. parse (regular expressions) them and escape them if necessary when using a database/command line *
Related
I am new to payPal. I'd like to use a simple PayNow button on my site. The problem is that I would like my webUsers to enter any amount they want to pay on my site and have it transfer to payPal when the Pay button is clicked.
This option does not seem to be available in any of the button types. They require preset amounts or entering the amount on the PP site. Is my only option to dive into learning the API?
Thanks, Mike
This may be what you need:
<form name="input" target="paypal" action="https://www.paypal.com/cgi-bin/webscr" method="post">
<input type="hidden" name="add" value="1">
<input type="hidden" name="cmd" value="_xclick">
<input type="hidden" name="business" value="YOUR BUSINESS NAME">
<input type="hidden" name="item_name" value="ITEM NAME">
<input type="hidden" name="item_number" value="ITEM ID NUMBER">
Other amount: €<input type="text" maxlength="200" style="width:50px;" name="amount" value="5.00"> EUR<br />
<input type="hidden" name="currency_code" value="EUR">
<input type="image" src="https://www.paypalobjects.com/en_US/i/btn/btn_buynow_SM.gif" border="0" alt="PayPal - The safer, easier way to pay online!">
</form>
Change the value of the variable business to the receiver email, i.e.:
<input type="hidden" name="business" value="receiver#email.com">
You may want to read HTML Variables for PayPal Payments Standard - PayPal Developer
I'm having an odd issue in node/sails and difficultly troubleshooting. I can upload small xls files via a upload form but larger ones do not process/upload, here is a simple test, when passed a small file (500-1000 rows) it processes fine and I get console logs. A large (20,000 row) file just spins on uploading.
My form looks like this:
<div class="row col-xs-12">
<form id="uploadForm"
enctype="multipart/form-data"
action="/utility/test_req"
method="post">
<label for="Parse Through Row" class="control-label">Parse</label>
<input type="text" name="num_rows" />
<input type="file" name="csv_file" />
<input type="hidden" name="_csrf" value="<%= _csrf %>" />
<input type="submit" class="btn btn-default" value="Upload CSV"/>
</form>
</div>
And my Controller looks like this:
test_req: function (req, res, next){
console.log("here");
console.log(req.params.all());
res.redirect('/utility/migration')
},
Move the _crsf token to the top of the form, i believe input fields are sent in order by the browser, and hence, parsed in the same order by sails. csrf tokens are time constrained so you get a short window of usage before they get invalidated, then if you have a big file, first your file gets processed(or files) and when sails is done with that it will parse your token, but then is too late.
<form>
<input type="hidden" name="_csrf" value="<%= _csrf %>" />
// The rest of the inputs here, including the file input.
<input type="submit" class="btn btn-default" value="Upload CSV"/>
</form>
It should work now :)
This was a csrf issue. Disabling csrf globally allows the controller action to be reached with larger files. I'm not sure if this is a configuration issue (likely) or a bug with csrf or sails (unlikely).
I have tried iframing but it doesn't worked in Javascript disabled browser. Anyone please tell me how can I mask an url and still worked in Javascript disabled situation, thanks in advance.
Use POST, rather than GET. Something like this early in the page:
<form action="nextpage" method="post">
<input type="hidden" name="parameter1" value="value1" />
...etc...
This page
</form>
<form action="otherpage" method="post">
<input type="hidden" name="parameter1" value="value1" />
...etc...
That page
</form>
Bit more longwinded, but it will work.
I've got a problem with the contact form in Expression Engine. I'm using the code from the docs but after submitting I'm getting this error :
This form has expired. Please refresh and try again.
My code:
{exp:email:contact_form user_recipients="no" recipients="my#emailadress.com" charset="utf-8"}
<h2>Support Form</h2>
<p>
<label for="from">Your Email:</label><br />
<input type="text" id="from" name="from" size="40" maxlength="35" value="{member_email}" />
</p>
<p>
<label for="subject">Subject:</label><br />
<input type="text" id="subject" name="subject" size="40" value="Contact Form" />
</p>
<p>
<label for="message">Message:</label><br />
<textarea id="message" name="message" rows="18" cols="40">
Support Email from: {member_name}
Sent at: {current_time format="%Y %m %d"}
</textarea>
</p>
<p>
<input name="submit" type='submit' value='Submit Form' />
</p>
{/exp:email:contact_form}
I'm using Expression Engine 2.8.0. Thanks guys!
EE requires an XID to be in the form. There is a global variable you can use to generate an XID hash:
<input type="hidden" name="XID" value="{XID_HASH}" />
http://ellislab.com/blog/entry/putting-the-secure-in-secure-mode-forms
For us, adding this to the config.php 'fixed' the problem (more like, put a bandaid on it since it's not an ideal situation)
$config[‘disable_csrf_protection’] = “y”;
I was having this problem only in Chrome and not in Firefox or Safari. I dug into the PHP and realized that it failed this check in Csrf.php:
// Fetch data, these methods enforce token time limits
$this->fetch_session_token();
$this->fetch_request_token();
// Main check
if ($this->request_token === $this->session_token)
{
return TRUE;
}
Then I realized that I had set Chrome to block cookies. I set it so Chrome would allow cookies and I am no longer getting that error message.
I think that's a problem with the secure forms XID hash. You can only submit a form once while using "secure forms" (to stop spammers hijacking them).
A quick way of disabling it is to open system/expressionengine/config/config.php and add this down the bottom to disable it. See if that makes a difference for you.
$config["secure_forms"] = "n";
Obviously using secure forms is preferable though.
I want to make a simple searchbox in my website. I think for my situation, the best way is to use something like w3schools.com did. When user types smth and press enter it redirects to google.com/search and it will search from only w3schools.com in google because there is site:www.w3schools.com is given in url. how can i do that?
A simple solution would be something like this:
<html>
<head></head>
<body>
<form method="get" name="searchform" action="http://www.google.com/search" target="_blank">
<input type="hidden" name="sitesearch" value="stackoverflow.com">
<input type="text" name="as_q" size="20" value="Search stackoverflow.com">
<input type="submit" value="Search" title="Search">
</form>
</body>
</html>
But you should also check this out:
http://www.google.com/cse/
Just browse source code and take everything you need, that trick will often do in case of HTML how-to's:
<form method="get" name="searchform" action="http://www.google.com/search" target="_blank">
<input type="hidden" name="sitesearch" value="www.yoursite.com">
<input type="text" name="as_q" size="20" value="Search yoursite.com">
<input type="submit" value="Search" title="Search">
</form>
Well. Actually it seems this is quite easy job. I have found the solution At:
http://www.askdavetaylor.com/how_can_i_add_a_google_search_box_to_my_web_site.html/
I think what you are looking for is Google Custom Search Engine. Start here: http://www.google.com/cse/docs/ , http://www.google.com/cse/manage/all