Can my webpage be subject to attack when a genuine user is submitting a form?

basically on sanitizing form data , validating against expected input in circumstances struggling know if after sanitization if data not match expected values, particularly if form being used genuine user @ time, poses question:

can page attacked @ same time genuine user submitting form, or using administration pages?

if can happen best thing if expected values not user input? wouldn't want redirect or cause error if had filled out form correctly other intrusion had entered form.

for example, values changed genuine user has input?

also on hidden fields, genuine user cannot see, these values changed?

my code this:

$sanitized = filter_input(input_post, 'form field', filter_sanitize_string);

$post['form field'] = $sanitized;

// validate either against expected arrays (if list menu), or expected patterns such letters or numbers

// on fields error presented if not expected not in case of hidden fields

is still possible values of posted form have been changed / added after these checks? , if best course of action?

i forward expalnation, gratefully received. 

>can page attacked @ same time genuine

>user submitting form, or using administration pages?

 

that's not how attacks work. common attacks need guard against sanitization include attacker using form inject code database. or bypass form , attack php script page directly. allow them exploit weaknesses in application , gain entry system, or cause cross site scripting attack affect legitimate users.

 

>for example, values changed genuine user has input?

 

probably result of xss type attack. example, user might click on link site contains malicious code in querystring web application processes without checking. alter values in form submit. long evaluate , sanitize data, should fine.

 

and attacker eavesdrop on site , gather data submitted unencrypted pages - exposing login credentials , other sensitive data. used gain access system, or used access other systems users use same credentials on many systems.

More discussions in Develop server-side applications in Dreamweaver

adobe