I have been told its kind of a bad idea to use a key as an attribute of an xml tag. I find the very handy for ajax as i can just stick the key i need in what ever element is being clicked,changed, or whatever. I can see how this is a security risk but have only used the tactic in internal apps.

On external application/sites what would be a better way to handle this. I would assume just embedding another unique field that isn't numeric.

Basic example... I have a button than when pressed would update the price of an item in the database. Then using JS on button press i would take the id and pass it back to the controller to update the item.

  • You mean placing a security key for access to your remote calls in your HTML? – Jarrod Nettles Aug 10 '11 at 16:03
  • No, just the key to some record in the database. I updated the question with a very basic example. – Ominus Aug 10 '11 at 16:58
  • Just noticed the part about xml tag. I assume you mean html tag. Like button ID? – jfrobishow Aug 10 '11 at 18:20

I don't see a problem with that per se.

The controller should validate the request anyway, if a user doesn't have access to something it should be stopped there.

For example,


Obviously you want to make sure the request is coming from someone who is allowed to modify ID 7 once you receive it, also a user who can edit the record ID 7 might not have access to edit the record ID 8.

You almost certainly don't want to start litering standard HTML with a bunch of keys like

<form ...>
  <input type="text" id="addressL1" name="addressL1" value="123 xyz blvd" addressValue="123 xyz blvd" addressID="6">

If you need them in a form, pass them as hidden fields with their own IDs.

"Be conservative in what you send; be liberal in what you accept." https://secure.wikimedia.org/wikipedia/en/wiki/Robustness_principle

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.