I was recently watching a msdn video titled "Top Web App Security Bugs in Custom Code" and he discussed a sitaution where a drop down listbox was disabled server side and then was maliciously enabled client side to select a new value which would then give the user a higher membership level. I can't remember if this was an aspx control or not, but I thought when aspx controls were disabled via server side they always maintanted their original values on the server after the postback regardless of what happens client side. Is this true?
Another question, I noticed on an aspx page if a user puts in javascript or html code into a textbox the page throws an error. Is the security tied to this strong enough to not have to validate this user input server side to try to protect against ...
Go to the complete details ...