Home/ Questions/Q 7646569
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-31T10:14:34+00:00

I’m trying to write an app that basically is a frontend for editing database

  • 0

I’m trying to write an app that basically is a frontend for editing database records. I have heard that a way to ensure the right row in the DB is being updated is to include a hidden form field on the update form with the row unique ID in it, and use this to add a conditional to the backend update statement.

However, this seems insecure. Anybody could edit the HTML on the page pre-submit and change the record being updated, no? What is the proper way to pass the unique ID of the row the user is editing along with their edits? I would imagine this may be done with cookies/session tracking, but couldn’t this be edited client side prior to submitting as well?

Thanks!

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    If a client is allowed to modify the record in question anyway, it doesn’t matter whether he does so by modifying the id in a hidden field or by going to the correct page and submitting the form from there.

    When any client submits any form, the server needs to a) make sure the client has the right to modify the record he attempts to modify and b) validate that the submitted data is allowable for the record. Then all your business rules are being protected and taken care of, whether the user uses the proper forms or not.

    You can also save a hash of all hidden fields in the session server-side and check that on submission to catch hidden field-manipulation attempts, if that’s still in your interest.

    • 0