在ASP.NET中，如何防止隐藏字段值被篡改
我有一个带有几个下拉菜单的用户控件。每当根据新选择的值更改其中之一时，我都会使用 ajax 重新填充下拉列表。
这些下拉列表之一的值是我想要绑定到数据字段的用户控件的最终值。
问题是 ASP.NET 无法识别下拉列表的值，因为它们是在客户端生成的。因此，我使用了一个隐藏字段，每当在下拉列表中选择一个值时，我都会将该值放入隐藏字段中，然后返回隐藏字段的值作为用户控制值，一切正常，除了
我担心用户可能会将该隐藏字段的值篡改为非法值。 有更好的方法吗？
I have a user control with a few dropdowns. I refill the dropdowns using ajax whenever one of them is changed based on the new selected value.
The value of one of these dropdowns is the final value of the user control witch I want to bind to a data field.
The problem is ASP.NET doesn't recognize values of dropdowns because they where generated in client-side. So I used a hidden field and whenever a value is selected in the dropdown I will put that value in the hidden field and I return the value of the hidden field as the user control value and everything works fine except
I'm afraid that a user might tamper the value of that hidden field to an illegal value.
Is there a better way to do that?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
如果您绑定到选择，用户也可以篡改这些值。只需验证隐藏字段，就像验证任何其他输入一样。并且不用担心漂亮的反馈，如果值超出范围，只需抛出异常即可。如果有人试图篡改你的表单，谁会在乎他是否会犯下丑陋的错误。
我想更简洁地回答你的问题：你无法阻止客户端的篡改，你所能做的就是验证 - 服务器端
If you were binding to the select a user could tamper with those values too. Just validate the hidden field like you would with any other input. And don't worry about pretty feedback, just throw an exception if the value is out of range. If someone is trying to fiddle with your form, who cares if he gets ugly errors.
I guess to answer your question more succinctly: you can't prevent tampering on the client, all you can do is validate - server side
始终验证服务器端的所有输入，添加客户端验证主要是为了向用户发出指示并防止不必要的往返。
Always Validate all inputs on the server side, Client side validation is added mainly to give instructions to the user and to prevent unessesary round trips.
您应该在服务器端验证所有客户端输入，无论您可以使用什么客户端验证。来自客户端页面的输入可以通过许多不同的方式被篡改，并且应该被视为不可信。
理想的安全实践是验证每个级别的输入，就好像来自前一级别的数据来自不受信任的来源一样。这意味着在客户端级别、服务器级别和 SQL 级别进行验证。
You should validate all client side input on the server side, regardless of any client side validation that you can employ. Input from a client side page can be tampered with many different ways and should be treated as untrustworthy.
The ideal security practice is to validate input at every level, as if the data coming from the previous level is coming from an untrusted source. This means validating at the client level, the server level, and the SQL level.