?? not sure what you mean ........
i always use POST never GET ??
Does GET not convert everything to URL's which is the opposite to what i want !
JT
Main Topics
Browse All TopicsHello over the last year i have been using self posting pages to perform my FORM validation which works great..... BUT the only problem I am concerned with now is security of passing URL variables to other pages instead of hidden FORM fields.
For Example (Self Posting Framework At Present)
<cfset errorflag = false>
<cfif IsDefined("FORM.submitbutt
<!--- Validate Data and set error messages if any to VARIABLES.Msg --->
<!--- If there are no errors perform what ya got to do --->
<cfif NOT errorFlag>
<!--- Perform Actions and move to next page --->
<!--- Successful Go To Next Page --->
<cflocation url="nextpagewithURLVarsAt
<cfelse>
<!-- validation failed, make the message pretty for the user -->
<cfset VARIABLES.Msg="The following error(s) were detected:<ul>#VARIABLES.Ms
</cfif>
</cfif>
Is there anyway to pass the the URL's as hidden form fields as a few users have caught on its just a matter to switch the numbers in the URL to get what they want !!
Benefits of self posting forms: -
Can populate Form Fields Values After Errors Occur easily
Personalised Error Messages For Each Validation Rule can be setup easily
Downsides
CFLOCATION can only pass values to next page as URLS ?!?
Any advice on how to improve my server side validation framework would be much appreciated..
Cheers
JT
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
not sure what you want
I think what you want is to avoid users from playing with the values in the URL, right ?
So what you can do is use POST for your forms. This way the values will never go in the URL querystring.
And if you want to pass on to the next page and take the values along/.....put all the values in hidden fields in a form and use javascript to submit the form
<form name=something>
<hidden fields....
</form>
<script>
document.something.submit(
</script>
makes sense?
Never thought of encrypt() pinaldave but sounds like to much work.....
Is there anyway to pass the FORM/HIDDEN variables to the next page of a self posting form without using Javascript/URLs as this sometimes in my situation could be turned off.
I am thinking about using the FUSEBOX 4.1 frameworks as it converts everything to ATTRIBUTES through the index.cfm page..
Help !
JT
Hi jturkington,
I think, if you do not want to use post method, javascript and URL param, I would use encrypt and decrypt.
<!--- This example shows the use of Encrypt and Decrypt --->
<h3>Decrypt Example</h3>
<p>This function encrypts/decrypts a string. Enter a string and a key.
<cfif IsDefined("FORM.myString")
<cfset string = FORM.myString>
<cfset key = FORM.myKey>
<cfset encrypted = encrypt(string, key)>
<cfset decrypted = decrypt(encrypted, key)>
<cfoutput>
<h4><B>The string:</B></h4> #string# <br>
<h4><B>The key:</B></h4> #key#<br>
<h4><B>Encrypted:</B></h4>
<h4><B>Decrypted:</B></h4>
</cfoutput>
</cfif>
<form action = "encrypt.cfm">
<p>Input your key:
<p><input type = "Text" name = "myKey" value = "foobar">
<p>Enter string to encrypt:
<p><textArea name = "myString" cols = "40" rows = "5" WRAP = "VIRTUAL">
This string will be encrypted (try typing some more)</textArea>
<input type = "Submit" value = "Encrypt my String">
</form>
Example from : http://livedocs.macromedia
Regards,
---Pinal
Business Accounts
Answer for Membership
by: jimmy282Posted on 2005-12-06 at 06:24:07ID: 15427580
use the form method=post instead of get.
That wont have anything in the url then,.