Question

i just started using data-* attributes to store custom attributes and values needed to View. for example .

<div id='someId' data-ItemValues='SomeValues'>
</div> 

based on the data-* i am doing some operations (CRUD) . what if user changed data-* attributes value in client side (ie from browser using firebug and some other developer tools) ?
i just want to know, is there any standards we need to follow or want to know how community handle this scenario.

Update :

i will validate in serverside also. but in some scenario. data is not stored in server. it will be in mark up. it will save only when user will hit save button.

i will pick the data, from javacript and use ajax to send values to the server. but my concern is that if user changed the values in data-* attribute, such that even server side validation will meet the rule to pass. then how do i prevent them ?

Answer 1

The rule is the same it has always been.

Never trust the client. Always verify and validate the values are what you expect, on the server side.

This applies to values in hidden fields, data passed in through AJAX or anything that comes from a machine not in your control.