Form Security & PHP?
<p>I was using something like this:</p>

<pre><code>&lt;input type="hidden" name="ids" value="1, 3, 5" /&gt;
&lt;input type="hidden" name="cost" value="350" /&gt;
</code></pre>

<p>But I was thinking, somebody could just change the cost to say "3" and pay for it for $3.00.. so I was thinking, would a securer(sp) option be setting these values into sessions when they load page, like so:</p>

<pre><code>&lt;?
unset($_SESSION['baskettotal']);
unset($_SESSION['basketids']);
$_SESSION['baskettotal'] = $grand;
$_SESSION['basketids'] = implode(", ", $ids);
?&gt;
&lt;input type="hidden" name="hash" value="&lt;?=md5('stackoverflow'.$_SESSION['baskettotal'].$_SESSION['basketids']);?&gt;" /&gt;
&lt;?
if (($_POST['hash']) != (md5('stackoverflow'.$_SESSION['baskettotal'].$_SESSION['basketids']))){
    echo "error";
    die();
}
?&gt;
</code></pre>

<p>Is this a good way of doing it? As they cannot edit the sessions, it's defined by whats in their basket, as opposed to storing it in hidden input fields which they could easily manipulate?</p>
