I’ve been wondering for a while now but I’ve yet to come up with a truly useful way of manipulating rows passed to the browser without exposing part of my DB. Basically what I want is a way to (1) Presenta table of elements retrieved from my database (2) Have the possibility to edit/delete my elements through AJAX.
Now my dilemma here is the fact that I’d ultimately have to pass an element’s ID giving the user access to it and possibly changing the values giving him the opportunity to hack my database. So my question is: What would be the ideal way of presenting an edit/delete button that lets me use ajax to get to my element on the server without exposing it to the user?
Should I use a hidden row in the table? Query the original field values?
A user isn’t going to hack your database if you escape your data and check the user has access to the data that they are updating prior to committing said update.
I would like to recommend you look at Backbone (http://documentcloud.github.com/backbone/) as it helps quite a bit with data manipulation.