Preferred Method To Implement Foreign Keys

Wappler General How To
#1

Which of these methods is preferred: an ID transported via URL to go to the next form page, or setup a SESSION variable to use through out the site?

For instance, the page starts with inserting the data for a user via form inputs. Then you choose that user from the list so that you can to add more details to the his profile, i.e., family info, job info, etc. All this is accomplished by transporting the identity of that user to the next page so that it can be used to connect all of his other details in other tables.

My question is which method of these two, URL or SESSION, is the most secure method of moving through this process? What would be the pros and cons between these two methods? Are there other means of doing this? Or does it even matter?

Thanks for you input and help.

#2

Personal preference: I tend to lean towards session variables for that sort of thing as they are hidden from the user. URL Parameters are displayed to the user in most cases.

2 Likes
#3

Thanks!

#4

You could consider cookies too. You can always set a re-direct if the Cookie is interfered with and the data source fails to load (Invalid Dynamic Event for example), or a show/hide region based on data returned successfully, same for Sessions or URL variables. This way you can safe guard in some ways the page itself should anything be a miss.

:slight_smile:

1 Like
#5

Hi @revjrblack
using parameters by URL, at the end you will always find someone who will change the number in the URL parameters…

I made now a reserved area all with Session in the State Management. People see nothing and you manage everything very easily.

1 Like
#6

So important to use a random string/hash/uid for any such exposed variable… Longer the better!

:smiley:

May sacrifice some performance DB side but security wise sometimes it’s a worthy compromise.

1 Like
#7

Further. You can log all hits to a specific page which is triggered if there are no results due to various forms of injection techniques. Three hits in a set period of time creates an account lock-down or at least an alert (you could use the Mailer component to send an E-Mail to an Admin for example).

:wink:

1 Like
#8

What would the equivalent be to the link example of webpage.com?id=3 if it is to be replaced with a session variable?

#9

It would just be webpage.com.

1 Like
#10

Haha… of course.

#11

on the link to the next page you must set

the link must set a href="#"
then on dynamic event:

on mouse click
then
assign the session variable (use datapicker to take the value)
then
browser component go to …

I m sorry cannot add screenshot I’m on my phone…

1 Like