I was recently watching a msdn video titled "Top Web App Security Bugs in Custom Code" and the presenter discussed a situation where a drop down listbox was disabled server side and then was maliciously enabled client side to select a new value which would then give the user a higher membership level. I can't remember if this was an aspx control or not, but I thought when aspx controls were disabled via server side they always maintanted their original values on the server after the postback regardless of what happened client side. Is this true?
Another question, I noticed on an aspx page if a user puts in javascript or html code into a textbox the page throws an error. Is the security tied to this strong enough to not have to validate this user input server side to try to pro ...
Go to the complete details ...