jeudi 26 avril 2018

How to safely pass database id's through POST

Good morning everybody! I want to know about hidden input fields and their use case. I am building a web application and I am displaying data in a table. I have transformed the data through queries so the user can read text values instead of their corresponding IDs. I am having a problem when updating a row, I have posted values instead of their IDs to display. Now when I post the information back to an UPDATE query obviously I have issues. My solution is I just post the ID's of those values through the hidden input field. I encoded the ID's but my worry is obviously if somebody really wanted to try to get at some data they would have some ID's to start with. What's the common practice here? Any and all advice will be great. I will post code if requested.

Thanks, Josh




Aucun commentaire:

Enregistrer un commentaire