Re: Form submit hash keys

Jason schrieb:
> ... would it make sense to just redisplay the page, with the submitted data
> intact, and a message to telling the user that their data was *not* submitted
> and to try again?

For Articles done on 2008-05-13 with
http://mt.xaraya.com/revision/diff/51cfc95d5f41656c47dce04bee97e853a449350e/with/f310676de2a1d5d3683c66a67cc06c49c8d7fa03

> Are there any security flaws with such an approach? ...

The submitting user gets his own data back. If another user would get it more
sanitizing would be better.

> The keys are supposed to stop a well-formed URL from submitting a form without
> the administrator (or other privileged user) realising it.

And to stop bot attacks, which I consider more worth. A do not double post check
could we easily do with javascript on client.