在写网站的时候，有修改资料的功能。我把用户ID放在type='hidden'的input里面了？
这样是不是特别不安全？
如果不放在这里面应该放在哪里，那些大网站在做修改或删除的时候哪些where条件都放在哪里了？
回复讨论(解决方案)
这不存在安全问题
你浏览资料的时候不都还把 id 放到 url 中吗？
这不存在安全问题
你浏览资料的时候不都还把 id 放到 url 中吗？
？？放在url中？？？好吧。
放在url都没问题，安不安全得靠你服务器做验证啊。
修改资料难道不是登录用户才可以吗？
关键看你的input ID主要是从哪里来的，要用来干什么?
放在url都没问题，安不安全得靠你服务器做验证啊。
修改资料难道不是登录用户才可以吗？
关键看你的input ID主要是从哪里来的，要用来干什么?
恶意用户把你的ID改了成了别的ID？怎么验证？
想跟大家讨论下一个大家在写这种类似的功能的时候把id或者code之类的条件放在哪里。
你放在 type='hidden' 中是修改不了的
如果一定要在调试工具里修改，那就不是好人了
如果说要防止，那就只有： 拔掉网线
放在url都没问题，安不安全得靠你服务器做验证啊。
修改资料难道不是登录用户才可以吗？
关键看你的input ID主要是从哪里来的，要用来干什么?
恶意用户把你的ID改了成了别的ID？怎么验证？
想跟大家讨论下一个大家在写这种类似的功能的时候把id或者code之类的条件放在哪里。
换成别人的ID之后怎么样，修改用户资料吗？
那修改权限，你都不检查吗，不检查是否是修改自己？
放在url都没问题，安不安全得靠你服务器做验证啊。
修改资料难道不是登录用户才可以吗？
关键看你的input ID主要是从哪里来的，要用来干什么?
恶意用户把你的ID改了成了别的ID？怎么验证？
想跟大家讨论下一个大家在写这种类似的功能的时候把id或者code之类的条件放在哪里。
换成别人的ID之后怎么样，修改用户资料吗？
那修改权限，你都不检查吗，不检查是否是修改自己？
怎么判断是否是自己？用session?那是不是就用hidden的ID就行了，直接用session里面的ID是不是就行了。
对啊，你登陆成功了可以记个ID在session里，然后编辑时检查session 里的ID是否等于url中或者hidden的ID不就可以判断出来是不是自己了。
Working with Flash Session Data in LaravelMar 12, 2025 pm 05:08 PMLaravel simplifies handling temporary session data using its intuitive flash methods. This is perfect for displaying brief messages, alerts, or notifications within your application. Data persists only for the subsequent request by default: $request-
Build a React App With a Laravel Back End: Part 2, ReactMar 04, 2025 am 09:33 AMThis is the second and final part of the series on building a React application with a Laravel back-end. In the first part of the series, we created a RESTful API using Laravel for a basic product-listing application. In this tutorial, we will be dev
cURL in PHP: How to Use the PHP cURL Extension in REST APIsMar 14, 2025 am 11:42 AMThe PHP Client URL (cURL) extension is a powerful tool for developers, enabling seamless interaction with remote servers and REST APIs. By leveraging libcurl, a well-respected multi-protocol file transfer library, PHP cURL facilitates efficient execution of various network protocols, including HTTP, HTTPS, and FTP. This extension offers granular control over HTTP requests, supports multiple concurrent operations, and provides built-in security features.
Simplified HTTP Response Mocking in Laravel TestsMar 12, 2025 pm 05:09 PMLaravel provides concise HTTP response simulation syntax, simplifying HTTP interaction testing. This approach significantly reduces code redundancy while making your test simulation more intuitive. The basic implementation provides a variety of response type shortcuts: use Illuminate\Support\Facades\Http; Http::fake([ 'google.com' => 'Hello World', 'github.com' => ['foo' => 'bar'], 'forge.laravel.com' =>
12 Best PHP Chat Scripts on CodeCanyonMar 13, 2025 pm 12:08 PMDo you want to provide real-time, instant solutions to your customers' most pressing problems? Live chat lets you have real-time conversations with customers and resolve their problems instantly. It allows you to provide faster service to your custom
Notifications in LaravelMar 04, 2025 am 09:22 AMIn this article, we're going to explore the notification system in the Laravel web framework. The notification system in Laravel allows you to send notifications to users over different channels. Today, we'll discuss how you can send notifications ov
Explain the concept of late static binding in PHP.Mar 21, 2025 pm 01:33 PMArticle discusses late static binding (LSB) in PHP, introduced in PHP 5.3, allowing runtime resolution of static method calls for more flexible inheritance.Main issue: LSB vs. traditional polymorphism; LSB's practical applications and potential perfo
PHP Logging: Best Practices for PHP Log AnalysisMar 10, 2025 pm 02:32 PMPHP logging is essential for monitoring and debugging web applications, as well as capturing critical events, errors, and runtime behavior. It provides valuable insights into system performance, helps identify issues, and supports faster troubleshoot
Hot AI Tools
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Undress AI Tool
Undress images for free
Clothoff.io
AI clothes remover
AI Hentai Generator
Generate AI Hentai for free.
Hot Article
Hot Tools
WebStorm Mac version
Useful JavaScript development tools
PhpStorm Mac version
The latest (2018.2.1) professional PHP integrated development tool
SublimeText3 Linux new version
SublimeText3 Linux latest version
Notepad++7.3.1
Easy-to-use and free code editor
MinGW - Minimalist GNU for Windows
This project is in the process of being migrated to osdn.net/projects/mingw, you can continue to follow us there. MinGW: A native Windows port of the GNU Compiler Collection (GCC), freely distributable import libraries and header files for building native Windows applications; includes extensions to the MSVC runtime to support C99 functionality. All MinGW software can run on 64-bit Windows platforms.
