Question

I need to retrieve a record from a database, display it on a web page (I’m using ASP.NET) but store the ID (primary key) from that record somewhere so I can go back to the database later with that ID (perhaps to do an update).

I know there are probably a few ways to do this, such as storing the ID in ViewState or a hidden field, but what is the best method and what are the reasons I might choose this method over any others?

Answer 1

It depends.

Do you care if anyone sees the record id? If you do then both hidden fields and viewstate are not suitable; you need to store it in session state, or encrypt viewstate.

Do you care if someone submits the form with a bogus id? If you do then you can’t use a hidden field (and you need to look at CSRF protection as a bonus)

Do you want it unchangable but don’t care about it being open to viewing (with some work)? Use viewstate and set enableViewStateMac=’true’ on your page (or globally)

Want it hidden and protected but can’t use session state? Encrypt your viewstate by setting the following web.config entries

<pages enableViewState='true' enableViewStateMac='true' /> <machineKey ... validation='3DES' />