Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have been told its kind of a bad idea to use a key as an attribute of an xml tag. I find the very handy for ajax as i can just stick the key i need in what ever element is being clicked,changed, or whatever. I can see how this is a security risk but have only used the tactic in internal apps.

On external application/sites what would be a better way to handle this. I would assume just embedding another unique field that isn't numeric.

Basic example... I have a button than when pressed would update the price of an item in the database. Then using JS on button press i would take the id and pass it back to the controller to update the item.

share|improve this question
You mean placing a security key for access to your remote calls in your HTML? – Jarrod Nettles Aug 10 '11 at 16:03
No, just the key to some record in the database. I updated the question with a very basic example. – Ominus Aug 10 '11 at 16:58
Just noticed the part about xml tag. I assume you mean html tag. Like button ID? – jfrobishow Aug 10 '11 at 18:20
up vote 0 down vote accepted

I don't see a problem with that per se.

The controller should validate the request anyway, if a user doesn't have access to something it should be stopped there.

For example,


Obviously you want to make sure the request is coming from someone who is allowed to modify ID 7 once you receive it, also a user who can edit the record ID 7 might not have access to edit the record ID 8.

You almost certainly don't want to start litering standard HTML with a bunch of keys like

<form ...>
  <input type="text" id="addressL1" name="addressL1" value="123 xyz blvd" addressValue="123 xyz blvd" addressID="6">

If you need them in a form, pass them as hidden fields with their own IDs.

"Be conservative in what you send; be liberal in what you accept."

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.