Go to Detail Page WITHOUT querystring

I'm not surprised they've failed to offer a reasonable solution. There isn't
one. There isn't any vulnerability in having a querystring. Presuming, of
course, that you've protected yourself against cross-site scripting and SQL
Injection.

--
Jules
http://www.charon.co.uk/charoncart
Charon Cart 3
Shopping Cart Extension for Dreamweaver MX/MX 2004

Thanks for the responses; I've typically done the same kind of security in the detail pages, but just wondering if there was a relatively simple way to remove info from the querystring. The company that does the vulneratiliby assessments for this client has indicated that they don't like to see "extra stuff in the URL address", but fail to offer a reasonable solution.

In essence, you'd also apply the same filter to the details page as you do
to the list page. This would ensure that users don't see each others
records.

--
Jules
http://www.charon.co.uk/charoncart
Charon Cart 3
Shopping Cart Extension for Dreamweaver MX/MX 2004

.oO(NewfWingNut)

>I'm familiar with the Go to Detail Page behaviour, but one thing that concerns
>me is the passing of querystring parameters. I have a page, for example, where
>I list employees by group. People see different lists, depending on which group
>they belong to, but there's nothing to keep someone from trying different
>querystring values and seeing results they should not be entitled to.

That's a bug in the script and has nothing to do with passing data in
the query string. If someone is not allowed to view particular data then
your script has to prevent it by checking that the person has sufficient
privileges.

>Let's say
>I see a link for Bob Jones, with the Go to Detail Page link generated as
>EmployeeDetails.asp?EmployeeID=27. There's nothing to keep a savvy user from
>changing the 27 to anything else, and perhaps seeing data they should not be
>permitted to see.

Yep, but you have to handle that in your server-side script. If user
"foo" is logged in and tries to access ?EmployeeID=42, then your script
has to check that "foo" is allowed to see that record. Most likely this
will require some hand-coding.

> I'd like to have a similar functionality that calls the other screen, but
>passes the selected row without it being visible in the querystring.

Impossible. Of course you could use a form and send the data with the
POST method, but this only makes it a little harder to manipulate the
data, it won't prevent it. Security by obscurity doesn't work.

Micha