Are drop down select fields vulnerable to any sort of injection

code-injection, listbox, mysql, php

Solution

Every single element in a website can be altered by a malicious user (hidden fields, divs, styles, ajax calls, you name it...).

That said, if you're already using Prepared Statements, you shouldn't worry too much about SQL Injection because mysql already knows what statements are going to be executed.

Instead you should sanitize all the output that is being rendered in a website.

Let's say that in your form, you're asking what country I live in this way:

 <select name="country">
     <option value="Mexico">Mexico</option>
     <option value="USA">USA</option>
     <option value="Canada">Canada</option>
 </select>

but I'm a malicious user, and I use Chrome's code inspector to alter your HTML, and I select Mexico, but change its value to

`<script type="text/javascript">alert("Hello World");</script>`

and if you output that value in another page this way:

 Your country is: <?=$country?>

Then you'll be writing:

 Your country is:
 <script type="text/javascript">alert("Hello World")</script>

and an alert box will pop up with the text "Hello World"

What harm can I make with that you may wonder...

well I can do anything I want with that, I can steal cookies or if that value is public (say that you're displaying that value in your frontpage), then I could redirect your users to another website, change your website's content... whatever I want.

To sanitize your users' output you can use

`htmlentities`

That will convert, for example, the `<` `>` symbols to its respective code: `&lt;` and `&gt`

Problem

I have read here the mantra "never trust user input" and it makes sense. I can understand that any field that is typed in by the user is suspect. However, what about drop down select fields? Can they be used for any type of injection? I have sanitized all the fields that allow a user to type in, and also used mysqli prepared statements for insertion into the database. However, there are three drop-downs in my form and was wondering if I need to do anything about them?

Original source