Re: Form submit hash keys

23-02-2009 13:10]:Jason wrote:
> Yes, the approach I think we should have, is - if the entry and exit points do
> not match up - is to basically create a new entry point and give the user
> another chance to submit the form. The point is not to dump them into an error
> page and discard all their data.

Sure, but how? If the submission is really "evil" the discarding is 
right, is it not?

How do you propose to distinguish the accident vs the real abuse? If 
you want to recreate the form *with* populated data in the traditional 
sense, i.e. the server processes the URI and displays the new form, 
that is basically the same as accepting the data, just conditionally 
processing it.

If that is the intention, that sounds ok, but has the risk of indeed 
opening up the secured submission, depending on what you do with the 
submitted data.

Perhaps i'm missing something?

marcel

-- 
Marcel van der Boom -- http://hsdev.com/mvdb.vcf
HS-Development BV   -- http://www.hsdev.com
So! webapplicaties  -- http://make-it-so.info
Cobra build site    -- http://cobra.mrblog.nl