I have a q. I have a testing site where registered users take tests. The problem I am running into deals with security. The app is set up like this:
User visits tests.aspx (the test listing page: this page lists all the tests that they can choose from)
Once the user clicks a test link, there are taken to the intro.aspx (introduction page, which lists the # of questions, etc.)
I use a query string in the intro.aspx page to check to see if the user has taken the test >> intro.aspx?id=0001,
As it stands, the code is written so that it checks whether the user and the test number are in the SETS table. If they are, then they are not allowed to take the test, if they aren't they may.
However, I realized that this is not secured. I realized all one had to do was delete the id part of the query (?id=0001) and hit enter. When the page came up as intro.aspx, the user was allowed to retake the quiz and now had t ...
Go to the complete details ...