Question

I Disable a textbox by c# code in an ASP.net Page with below code:
Textbox1.Enabled=false;
to prevent user changing a specific value.
as you know Textbox1.Enabled=false; in html mode will convert to disabled=”disabled” css prpoerties.
but unfortunately end user can remove this css properties by Firefox Firebug and enable the textbox and press the submit button and send the changed value to server.
so what can I do?

Answer 1

You should never – ever – trust user input. Everything submitted via website form is user input. There is nothing you can do to prevent someone from submitting anything they very well please, and you should not even try.

Instead, you should check/validate those values on the server. If it’s a value you just want to display to them, but not allow them to change, then just don’t have your code-behind check the value at all… since you know it should not change.

If you are enabling/disabling that TextBox based on whether the user is an ‘admin’ or something… then you are doing it wrong.