The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

the server will stop processing the form when it identifies the first invalid

field, and so your testing is not reaching all possible code paths within

the application.

N OT E

Client-side JavaScript routines to validate user input are extremely

common in web applications but do not infer that every such application is

vulnerable. The application is exposed only if client-side validation is not

replicated on the server, and even then only if crafted input that circumvents

client-side validation can be used to cause some undesirable behavior by the

application. 

Chapter 5 

■

Bypassing Client-Side Controls

109

70779c05.qxd:WileyRed  9/16/07  5:14 PM  Page 109

---