Question

In my asp.net MVC application I am using in place editors to allow users to edit fields without having a standard form view. Unfortunately, since I am using Linq to Sql combined with my data mapping layer I cannot just update one field at a time and instead need to send all fields over at once.

So the solution I came up with was to store all my model fields into hidden fields, and provide span tags that contain the visible data (these span tags become editable due to my jquery plugin). When a user triggers a save of their edits of a field, jquery then takes their value and places it in the hidden form, and sends the whole form to the server to commit via ajax.

When the data goes into the hidden field originally (page load) and into the span tags the data is properly encoded, but upon the user changing the data in the contenteditable span field, I just run

$("#hiddenfield").val($("#spanfield").html();

Am I opening any holes this method? Obviously the server also properly encodes stuff prior to database entry.

Answer 1

Assuming your server is properly detecting and dealing with XSS attempts, there’s no way a malicious user could submit an attack for another user. Unless someone wants to hack themselves(?), it seems secure to me.