Submitting a form without leaving a page

[drf1229]

I am trying to automatically submit a form without the user knowing. I want the form to run anonymously and not change the page. The issue I have is that I do not have access to the php page that is the action of the form. Is it possible to do this without changing anything in the action page?

Edit: I have found my answer! What I do is add a hidden iFrame to submit the form in the background!
Ex.


Formsubmit.php:

<form id="form">
</form>
<script type="text/javascript">
document.getElementById("form").submit();
</script>

index.php:

<iframe src="Formsubmit.php" height="0" width="0"></iframe>

 

[misson]

Use AJAX rather than submitting the form. You can add a submit handler to the form that cancels the default action (to prevent the form handler page from loading).

 

[Twinkie]

I am assuming you know that the proper way to do that would be AJAX, but (for security reasons) it is not allowed to send data to files on another server than the page you are viewing.

My only idea would be to gather the data from the forms (without submitting it) via HTML DOM, send it with AJAX to your own server, then fsock it with PHP to its destination.

Other than that, you would need an assisting technology like Flash or Java, which could probably do it better. However, nothing *in the browser* that I know of.

I was going to say client side, but I think that is technically incorrect.
Edit:
*facepalm* how could I forget about iframes...

 

[phpmain2]

That is the simplest way to do so (believe it or not, when I read your post title a minute ago, IFrames popped into my head). However (albeit relatively small), some browsers do not support IFrames.

 

[misson]

Edit: I have found my answer! What I do is add a hidden iFrame to submit the form in the background!

Edit: *facepalm* how could I forget about iframes...

Iframes count as AJAX, believe it or not. XMLHttpRequest is just a newer option. Iframes are still used, especially if you want cross-domain communication.

 

[drf1229]

Iframes count as AJAX, believe it or not. XMLHttpRequest is just a newer option. Iframes are still used, especially if you want cross-domain communication.

thanks for the useful post. I had no idea iframes could be so helpful/harmful. Have you ever seen any severe iframe attacks?

 

[misson]

Have you ever seen any severe iframe attacks?

Do you have a particular exploit scenario in mind? The current iframe security model goes a long way towards securing iframes. Bugs in the implementation of same still present exploits, however, and XSS exploits are ever a problem.

 

[smoke.sessions]

Yeah, I would use AJAX for that. Otherwise, I think jQuery has functions like that.

 

[drf1229]

Do you have a particular exploit scenario in mind? The current iframe security model goes a long way towards securing iframes. Bugs in the implementation of same still present exploits, however, and XSS exploits are ever a problem.

Ok, I was just curious what to watch out for in the future.

 

[misson]

In terms of sites you develop, consider page access (which cross-domain restrictions help secure) and injection attacks (which is entirely up to you to prevent).

 

[drf1229]

Ok, well are there any other tags I should filter to avoid injection attacks (like in a feedback page)? I currently have meta, script and iframe. Would it be easier to just strip html tags?

 

[misson]

Rather than stripping bad tags (blacklisting), allow only good tags and attributes (whitelisting) or use a lightweight markup language (e.g. BBCode, like the X10Forums, or MarkDown). If you end up allowing any HTML, don't write your own parser; use PHP's DOM or one of the other XML parsers.

 

[drf1229]

Sounds good, thanks