Securing web forms

Secured web forms in 3 steps

1. Initialize

In this step you include the PHP code and select a method. Important: Be sure to put this before the TUCAL function seite()!

<?php
require_once('php/secform.inc');
$secform = new tucal_secform(0);     # 0, 1, or 2
seite(__FILE__);

The following protection methods are currently implemented:

• 0 – invisible token
• 1 – token and time check - "invisible"
• 2 – token, time check and JavaScript checkbox: "I'm human" - visible, JavaScript required

Normally, method 1 should be sufficient. All variants also protect against CSRF attacks and prevent multiple submissions of the form.

2. Place secret in the form

Put the HTML code that the PHP function get_token() returns in your HTML form:

<form action="mod_secform.php" method="post" class="form-horizontal">
 ...
  <?php echo $secform->get_token(); ?> 
  <button type="submit" class="btn btn-default" style="margin:1em">Send</button>
   </div>
</form>

3. Checking in the form evaluation

Use the function check_token(min, max) to check the protection method. min, max are numerical values in seconds. In this time range human user should be able to fill the form. You can see the usage in the example:

<?php
  # Form evaluation
  # time for the user to fill in the form - here:
  # minimum 5 seconds, maximum 900 seconds = 15 minutes
  # use $secform->check_token(0, 0); to turn off the time check
  list($ok, $reason) = $secform->check_token(5, 900);
  if ($ok) {
      # general form evaluation
  } else {
      # output error, e.g. $reason, and/or simply display form again
      echo 'Error: ' . htmlspecialchars($reason);
  }