Home/ Questions/Q 500083
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-13T06:03:04+00:00

I’m creating a wizard-based series of forms for taking user inputs. One of the

  • 0

I’m creating a wizard-based series of forms for taking user inputs. One of the requirements for that wizard is that the script (PHP) cannot save the inputs into the database (MySQL) until the user clicks the ‘Save’ button, so I have to device a mechanism to transport user inputs in one form to another when the user clicks ‘Previous’ or ‘Next’ buttons. I looked into using various methods including cookies, sessions, temporary files etc, but I settled for embedding base64_encoded serialize data in a hidden field that exists in all the forms in the series. The value in this field will be decoded on form submissions and re-encoded for putting in the next form after other values from the current form are inserted.

Here is a sample of how the hidden field looks:

<input type="hidden" name="wizard:presave" value="YTo2OntzOjU6InRpdGxlIjtzOjEwOiJRdWVzdGlvbiAyIjtzOjQ6InRleHQiO3M6MTk6IlllcyBpdCdzIGEgcXVlc3Rpb24iO3M6NDoidHlwZSI7czo2OiJjaG9pY2UiO3M6NzoiY2hvaWNlcyI7YTowOnt9czo1OiJwb2ludCI7aToxO3M6Mjoib3AiO3M6MTM6ImVkaXRfZXhlcmNpc2UiO30=" />

So the questions are:

  1. Is it considered a good/bad practice?

  2. Is there any length limit of hidden fields in HTMLform?

  3. What are the possible security issues?

  4. And are there better alternatives? (with explanations, preferably without using javascript)

Thanks in advance!

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    1. I’ve never seen this particular method of parameter passing in my career, so I can’t say whether it’s good or bad. It’s certainly not “standard”. Standard methods would either be passing the submitted method along (unencoded/normally) using hidden inputs, or storing in session. I think you might be making work for yourself, so in that sense it would lean towards “not ideal”.

    2. As long as you are using POST for your forms, there is no defined limit for data sizes that I’m aware of in the HTTP specifications. Older servers may have practical limits, but unless you’re doing something extreme such as media file uploads, they shouldn’t be a worry.

    3. Possible security issues are the normal web security flaws. Anything you take from a user and re-output to a page could contain cross-site scripting vulnerabilities and would have to be properly sanitized (this is somewhat moot if you’re encoding everything). Users can craft their own data and submit it if they like. Basically, assume all the data you handle is unsafe and tainted.

    4. Sessions would work much better here. The data the user submits wouldn’t have to go through a lengthy encoding process. As well, you’d only have to validate it once. After it’s been submitted and validated, you can simply store it on the server in $_SESSION and leave it alone until the final button is clicked. Otherwise, you have to worry about re-outputting it, re-receiving it, and re-validating it at each step. A malicious user could submit one set of data, have it checked and re-output as encoded data, but then craft the next form submission by unencoding, changing data, and re-encoding.

    I would highly recommend that you reconsider sessions, as it simplifies all your data operations into a “do-once” scenario.

    • 0