Writing secure forms

[fluiduk]

Hi All

Working on a fairly simple shopping cart using Protx and have an issue

It might be best to outline the process at present

checkout.asp - User adds items to cart, confirms quantities etc and presses 'checkout'. This redirects them to payment.asp (via ssl) where they enter their card details etc.

payment.asp - The user enters their card details. There are some hidden form field fields also, these are retrieved from the database, i.e billing address and postcode. Once the user enters their details the form is securely posted to the Protx payment page on our server that does all the work with Protx.

The issue at the moment is that I want to secure payment.asp in that I don't want anyone to be able to view the form source code and the hidden values it contains.

The card details are posted securely to the next page so that isn't a major issue, its just people viewing the hidden fields thats an issue.

Any help appreciated as this is the first time I have tackled this kind of thing

Thanks

 

[fluiduk]

Also...

Whats the best way to secure a form... ie to stop unauthorised people trying to post to the action script?

Thanks
Aaron

 

[fluiduk]

At the moment the only thing the client sends to the payment page is the card details and the order number.

The script retrieves the rest from the database.

Is that going to help?