At first glance this topic seems to belong in another forum but the reason I am posting here will become apparent later.
I have a table in my app where one column is named staffID.
That being said,what is contained in that column(the values I mean) are placed as values in the data attribute of an in input element.
The data attribute has the name data-staffID and I need in order to run update queries on the server side.
Elaborating a little,the value that is contained in data-staffID is sent to the server via ajax.Here is an example:
What you name a field has no effect on security. The only thing that can affect security is the value being stored in the field (such as if you encrypt the value before using it in the page and decrypt it again if it is passed back to the server…
well, the reason I said that it might raise security issues is that if the name stays as it is now(staffIF)might make suspicious someone that this refers to a table column name.
Of course I can always change the name.
Lastly I agree about encrypting the value,which in the bottom line it is the cause of security concerns.
Those two above I do not think they apply here.This Id I am refering to is not entered in a form by the user but embedded in an html input element as a data- attribute that had been previously taken by the a database table.
That’s precisely what sanitization is for - fields that the user is not supposed to touch but where they could. Basically it means stripping out any invalid characters. As the untouched field will not contain invalid characters it will pass straight through but if someone tampers with it in an attempt to break security then at least part of their code will be stripped out.
Validate user inputs.
Sanitize inputs from all other sources.