Question re SQL injection and dropdown boxes

Do dropdown boxes offer any protection over text fields

[cmendla]

This might be a dumb question..

We have modified the advanced search form on an oscommerce site. All of the additional fields on public side are dropdown boxes, not text input fields.

Does this provide any additional protection from SQL injection attacks? I'm wondering how anyone could run an attack since they can't try to put code in a text field.

Thanks

cg

[d40sithui]

I'm wondering how anyone could run an attack since they can't try to put code in a text field.

i'm thinking of a nonlocal script that has your action script as the target. in other words, the attacker can write his own form with the same variable names are yours and submit it from his website to you. you should always filter your data.

[StoutFiles]

Form data has to be filtered; browser extensions like Firebug let you edit form source code and submit whatever you want. All entries will need to be checked before used in SQL calls.

[Demaestro]

There is no added protection there at all... someone savvy enough to perform an SQL injection is going to be savvy enough to spoof your form.