Personally, I think this is an issue that is heavily "overblown" by the
so-called security pundits. Sure, if somebody manipulatiing your querystring
is going to
cause financial or other security breaches, of course it's an issue. But in
many
cases it is used for nothing more than simple navigation or in your case for
deciding whether to call a method that displays some control or not.
You can still use the querystring and obfuscate it quite nicely. Here is an
article
I did on a technique for this. You can see how I got flamed for it by people
with nasty agendas who either cannot read, or never even got past the third
paragraph:
http://www.eggheadcafe.com/articles/20060427.asp
Peter
--
Co-founder, Eggheadcafe.com developer portal:
http://www.eggheadcafe.com
UnBlog:
http://petesbloggerama.blogspot.com
"MRW" wrote:
Quote:
Mmmm... is there a way to bypass that problem? Not that it's the
biggest problem in the world...
>
Mark Rae wrote:
Quote:
"Peter Bromberg [C# MVP]" <pbromberg@yahoo.nospammin.comwrote in message
news:FBAAA33C-7554-46B7-9A13-E0CBA4565075@microsoft.com...
Quote:
You should also check for querstring being null above this.
And also for users changing the QueryString manually...
>
>