Lets say there is an AJAX application where the user can submit items - buy them.
And there was a code
IF ($_POST[items] > 20) {
echo 'error';
}
else {
do_buy($_POST[items]);
echo 'success'
}
Here, there is a check if items
is not more than 20. On client side, it should not be possible to choose more than 20 items.
The system would work without problems even if 21 (or more) items were submitted (the user would simply pay for each item). While I realize you must want to yell don't trust the client, is there any harm in doing so if there are no consequences, as is the case here?
One could make the argument that overloading the cart might cause instability in the system but it seems as though the worst case would be that some script times out. If errors are disable, the user will just not get back any response.
In general: Does it make sense to code protections for an attack which violates an invariant of your system?
Update:
$_POST['items'] I meant that is array, not an integer. And each item how own properties - id and quantity, which are checked later before completing the buy operation.
About sql injection - I usually use frameworks, and they take care of injection protection.
Update
One more reason why I ask this is I want as much clean code as possible and also when someone reads it - will think why the hell this is needed, this programmer does not know what he is programming and why. So for all code I want to have clear reason why that piece of code exists and so if not in comment, then at least myself that I would have clear understanding why I make this check so I could explain if another programmer asks.