.oO(NewfWingNut)
>I'm familiar with the Go to Detail Page behaviour, but
one thing that concerns
>me is the passing of querystring parameters. I have a
page, for example, where
>I list employees by group. People see different lists,
depending on which group
>they belong to, but there's nothing to keep someone from
trying different
>querystring values and seeing results they should not be
entitled to.
That's a bug in the script and has nothing to do with passing
data in
the query string. If someone is not allowed to view
particular data then
your script has to prevent it by checking that the person has
sufficient
privileges.
>Let's say
>I see a link for Bob Jones, with the Go to Detail Page
link generated as
>EmployeeDetails.asp?EmployeeID=27. There's nothing to
keep a savvy user from
>changing the 27 to anything else, and perhaps seeing data
they should not be
>permitted to see.
Yep, but you have to handle that in your server-side script.
If user
"foo" is logged in and tries to access ?EmployeeID=42, then
your script
has to check that "foo" is allowed to see that record. Most
likely this
will require some hand-coding.
> I'd like to have a similar functionality that calls the
other screen, but
>passes the selected row without it being visible in the
querystring.
Impossible. Of course you could use a form and send the data
with the
POST method, but this only makes it a little harder to
manipulate the
data, it won't prevent it. Security by obscurity doesn't
work.
Micha
4
Replies
AdChoices