Question

I currently have a set of hidden input, the values are altered with jQuery.

echo "<input type='hidden' id='stack-information-1' value='$clickedtitle' readonly />
<input type='hidden' id='stack-information-2' value='$guidelinename' readonly />
<input type='hidden' id='stack-information-4' value='$clickedid' readonly />
<input type='hidden' id='stack-information-5' value='$starter' readonly />
<input type='hidden' id='stack-information-6' value='$category' readonly />
    <input type='hidden' id='stack-information-7' value='$sid' readonly />
    <input type='hidden' id='stack-information-8' value='$clickedposition' readonly />
    <input type='hidden' id='stack-information-9' value='0' readonly />";

I don’t want the user to be able to change these values via hacking etc. This isn’t valuable information, just integers and non-important strings. However what security measures do i take to prevent the user changing these values? Do i save the values in sessions?.. if so how do i access the values with jquery?

Answer 1

Storing them anywhere on the client-side will leave them open to being read.

I suggest if they’re only temporarily relevant values to store them in the session and handle them only in the backend when you process whatever call they are related to. (i.e. don’t output them to the client at all).

If your javascript needs them to make some modification to the page, that logic should be relocated to the backend and called via ajax to ‘ask the server’ what the js should do.