Databases
StackOverflow2013
Postsdbo
POServer Side Validation Preventing Database Errors
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POServer Side Validation Preventing Database Errors
    primarykey
    data
    text
    <p>I'm fairly new to server side coding and am currently setting up a site which involves pulling objects from a database, allowing a user to edit them, and then re-inserting these elements in to the database. </p> <p>However, I'm not sure how to prevent the user from ruining the database through the use of development tools. </p> <p>Essentially elements are displayed in a list and each element is a script. It has it's own unique ID and a name (not necessarily unique). So, when it is pulled from the database, the name is the list's text and the id is contained within an attribute field. When they're edit, I pull the id from the html attribute and use that to save any changes to the database. </p> <p>Of course, I make checks server side to determine if all of edits the user made are allowed. </p> <p>But, the problem I'm running into is that the user could easily open up any form of developer tools, change scripts Id's (switch them or vary them in any way they please) and this would definitely hurt the database. </p> <p>Could someone provide me a few techniques to prevent this issue? I'd really appreciate it. Thanks!</p> <p>I don't know how it'll help, but the majority of my code is in Javascript (using jquery and jquery ui) and php (using CodeIgniter as the framework).</p> <p><strong>EDIT:</strong> </p> <p>Imagine two elements</p> <p>Id -> Title -> Description</p> <p>5 -> Hello -> World</p> <p>6 -> Bye -> Sleep</p> <p>On server side, these are displayed as lists and there's an alternate way to edit the values.</p> <pre><code>&lt;li data-id=5&gt;Hello&lt;/li&gt; &lt;li data-id=6&gt;Bye&lt;/li&gt; </code></pre> <p>Someone can load up fire bug and change the data-id's that I use for queries, say make the first one 7. Or swap both. In this case, that doesn't really matter, but it's actually more for my curiosity, is there any way to prevent this?</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USuser1464055
    1. USuser1464055
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POServer Side Validation Preventing Database Errors
      1. This table or related slice is empty.
      1. VTUpMod
    1. COYou have to [**validate**](http://en.wikipedia.org/wiki/Verification_and_validation) the user input on the server (***not*** on the client).
      singulars
      1. POServer Side Validation Preventing Database Errors
      1. USMatt
    2. CO"Of course, I make checks server side to determine if all of edits the user made are allowed." But, I don't know how to check if the id numbers of the scripts were changed, since those are what I'm mainly querying with. Everything else is pretty much up to the user to edit at will.
      singulars
      1. POServer Side Validation Preventing Database Errors
      1. USuser1464055
    3. COcheck when reading the info (redirect to naughty step) and check when writing it (go directly to jail, do not pass logout page, do not collect $200).
      singulars
      1. POServer Side Validation Preventing Database Errors
      1. USWaygood
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload