Form submit hash keys
Jason <[email protected]> Mon, 23 Feb 2009 10:44:21 +0000
| Newsgroups | gmane.comp.cms.xaraya.devel |
|---|---|
| Organization | Xaraya |
| Message-ID | <[email protected]> |
I just had a thought about these hash keys. Submitting a form twice accidentally, or losing the hash key to a form display in another page, results in the nasty "keys don't match and now I have thrown all your carefully-entered data away, have a nice day" error. Instead, would it make sense to just redisplay the page, with the submitted data intact, and a message to telling the user that their data was *not* submitted and to try again? Are there any security flaws with such an approach? I can't think of any, but it would make forms a lot more friendly. The keys are supposed to stop a well-formed URL from submitting a form without the administrator (or other privileged user) realising it. By re-presenting the submitted data as a form, this requirement would still be met. -- Jason