Question

I have form to add post where’s title, description fields and one hidden field.
Post has many subcontents (text, photo, video).

Now, every new subcontent (as Javascript object (hash)) is added to Javascript array variable. After click submit button, array variable is moved to hidden field value and form send request to create new post (with title, description and field with subcontents).

It’s any safe way to do this (eg. now hacker can add subcontent via JS Console without validation check)?

Answer 1

Anybody can add any data to any POST, with javascript or not. I can use curl to submit whatever data I want to your server. It’s up to your server-side application to filter out the bad stuff and validate the good stuff.