Re: Form submit hash keys

Hb wrote:
> Jason schrieb:
>> ... would it make sense to just redisplay the page, with the submitted data
>> intact, and a message to telling the user that their data was *not* submitted
>> and to try again?
> 
> For Articles done on 2008-05-13 with
> http://mt.xaraya.com/revision/diff/51cfc95d5f41656c47dce04bee97e853a449350e/with/f310676de2a1d5d3683c66a67cc06c49c8d7fa03
> 
>> Are there any security flaws with such an approach? ...
> 
> The submitting user gets his own data back. If another user would get it more
> sanitizing would be better.

I wonder if there is any danger when the data that comes back was supplied by a
dodgy URL, possibly containing JavaScript that could then run on the page if
redisplayed in a preview?

-- Jason