Masking text out on sensitive data

Hi,

Without getting into issues of security, you could use a session variable to hold each 'real' (unmasked) value on the form and results page and use a regular expression to replace the characters with Xs.

Form Page

<cfscript>

     // store the actual values in the session scope (NOTE: session management must be enabled in your app for this to work!)

     session.logonid = query_from_db.logonid_column;

     session.other_secret_field = query_from_db.secret_field_column;

     // now, mask them for use on the form --

     // the regular expression below finds any and all alphanumeric character and replaces it with an X

     logonid_masked = ReReplaceNoCase( session.logonid, '[\w]', 'X' ,'ALL' );

     other_secret_field_masked = ReReplaceNoCase( session.other_secret_field, '[\w]', 'X', 'ALL' );

</cfscript>

<cfoutput>

     <input type="text" id="myfield" value="#logonid_masked#" />

     <input type="text" id="myfield2" value="#other_secret_field_masked#" />

</cfoutput>

You could use the same approach as above on the results page.

Hope this helps!

Craig