RE: [PHP4BETA] hidden variables !<form>

There is a reason to use a POST for security reasons - SSL would make them
secure in transit. Yes, you can see the variables, but a GET method would
not allow those variables to be encrypted.

To "auto" POST, add a generic JavaScript "onClick" handler to EVERY link
like this:

 <a href='../somedirectory/index.phtml' onClick='return postTo( this )'>

(note: if the page is written in PHP, I like to use a PHP function that will
create the HTML href tag)

Then in JavaScript, postTo() looks like this:

  function postTo( link )
  {
    document.forms[0].action = link.href;       // note assumption that
there is just one form!!
    document.forms[0].submit();                 // off we go
    return false;                               // must return false for
this to work
  }

Dan Sevush
CTO Dan's Chocolates
www.danschocolates.com - We donate 5% of your purchase to a good cause that
you select.

>     If security is a concern for you then you should only use
> them as a sesion ID at most and back that up with some other
> Identifier. The reason
> is that 'post' method using hidden fields are just as vulnerable to
> manipulation as 'get' method. Fewer people will try it but it all just
> depends on how secure you want it. Storing variables using
> hidden fields
> are still stored by the browser and transmited to the server just as
> cookies are, and thus still subject to end user manipulation.