Can an attacker write something to input hidden?

Question

PHP

Hello. I have a js script on my site that does some calculations and then outputs them to input hidden. Further, this data from input hidden is transferred to php and then to the database. Is it possible to change the text in input hidden so that this text then goes to the database?

Answer 1

I have a js script on my site that does some calculations and then outputs them to input hidden. Further, this data from input hidden is transferred to php and then to the database.

OMG!!!!! It is better to immediately make a field: "enter the price" and the "buy" button.
Any important calculations must be done on the server side.
If you count something - make it an option by id-shniks, and already on the server - take values ​​by these ID-shniks and perform any mathematical operations with them.

Answer 2

It is possible and even possible to replace the request completely.

Answer 3

Maybe. Everything that comes from the user needs to be checked on the server side.

Answer 4

Well, what do you think, maybe or not, if you can open Google Chrome with Developer Tools and modify almost anything on the front-end?

Answer 5

hidden-ohm it is only for a normal user, and even he can guess to install Firebug - and that's it, your hidden is not hidden anymore ...