Skip to main content
M
MikeL7
Inspiring
April 27, 2007
Answered

How can i mask a URL parameter

  • April 27, 2007
  • 2 replies
  • 437 views
I have a instant messaging app and i need to mask the URL parameters that uniquely identify the message (autonumber in access db) so that a user cant change the parameter number in the browser click refresh and delete a different message#
How can i mask the msdID=<number> from showing in the browser to prevent a user from deleting or saving someone elses messages? I know it can be done
to see the example got to: http://gohbcc.com/CallCenter/EMPLOYEEMessagesVIEW.asp and enter USERNAME: admin PASSWORD: 1234
any option would be great
MikeL7
This topic has been closed for replies.
Correct answer MikeL7
Your message helped, i put the code to create the variable just before the repeating region table and then made form buttons that post the variable and labeled the buttons and it works perfect. THANKS

2 replies

N
Newsgroup_User
Inspiring
April 27, 2007
> How can i mask the msdID=<number> from showing in the browser to prevent a
> user from deleting or saving someone elses messages?

This would be security through obscurity which is a bad idea.

Don't worry about masking the message. Instead, check the permissions of the
message on the server before returning it to the browser.

If you can't/don't want to do that, at the very least you could use server
sessions to pass the info instead rather than querystrings.

-Darrel


C
Creativ_Technologies
Inspiring
April 27, 2007
Use the post method instead of get.
M
MikeL7AuthorCorrect answer
Inspiring
April 28, 2007
Your message helped, i put the code to create the variable just before the repeating region table and then made form buttons that post the variable and labeled the buttons and it works perfect. THANKS
Terms & ConditionsAccessibility statement
Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices