Search code examples
phpdrop-down-menusanitizationwhitelist

Sanitising drop down options with a whitelist

I have had a look at this link: https://www.owasp.org/index.php/Input_Validation_Cheat_Sheet which discuss the use of whitelists on drop down menus.

What I dont get is why would you use a whitelist on a list of options when that is all there is to choose from?

I understand why you would use it on user input like typing in your name etc but I dont get why you would use it on options as the user is not physically typing something in.

Or have I just read this wrong?

Solution

  • You are assuming that they will use your form to post to the form processor, but that is not necessarily the case.

    Apart from that it is easy to modify the values from the dropdown using for example firebug and post the form after that.