Question regarding form security

[eluser]gunnarflax[/eluser]
If I display a form with users in a dropdown that fulfill a certain requirement, do I need to check that the later submitted form also have a user that fulfill the same requirement? Can that value be changed by the user even if it's in the HTML and not directly editable by the end user? Can it be changed with some tool like firebug?

[eluser]Eric Barnes[/eluser]
I am not 100% sure I follow but yes forms can be spoofed and data can be inserted that you do not account for. All it takes is viewing source, creating an html file from this, altering it, and submitting.

Of course it is also a good idea to make sure all post data originates from your domain but that is another topic

[eluser]gunnarflax[/eluser]
[quote author="Eric Barnes" date="1310505292"]Of course it is also a good idea to make sure all post data originates from your domain but that is another topic [/quote]

How do I do that?

[eluser]Eric Barnes[/eluser]
[quote author="gunnarflax" date="1310507074"]How do I do that? [/quote]

Here you go - https://gist.github.com/1078474 :coolsmirk:

[eluser]gunnarflax[/eluser]
Thanks! Much appreciated!