如何防止客户端用户更改onClick函数中的参数？

Question

I just realized while testing an onClick function with firebug that it would be really easy for a user to change the value of the arguments being passed. This could mess thins up.

Is there any easy way to prevent this, especially when arguments need to be passed?

Answer 1

It is impossible. The code is executing on the user's computer. They are in control.

If they edit it and "mess it up", then that is on their head.

If they edit it and it submits an HTTP request to your server, and your server allows (for instance) that request to delete data belonging to another user then the problem is that your server didn't check that the user submitting the request had permission to delete that data before following through.

Answer 2

You cannot trust anything sent from the client. The user might hand-edit the URL arguments, or a script kiddie could send you a request not even using a browser at all. You must validate everything server-side.

Answer 3

No, this simply can't be done.

Once the script is loaded to the client's machine. He can use/modify it, as he wants.

Answer 4

I'd recommend validating the arguments against expected set of values, and/or business rules wherever the results are being processed (client/server). Ideally validation checks happen on the server where the user has no control. Validation on the client side could even be modified to allow invalid data entry.

There is no way to completely control it - only validate it based on criteria.

Answer 5

You can't prevent this action because JavaScript is a client side . Also you can never trust the client .

You should make a validation for any request at server side to protect your data against client misuse .

you can somehow make it hidden from client eyes
by using .delegate()

EX.

$("table").delegate( "td","click", function() {<br>
  // write here your function<br>
}); 

The client can execute this script but it isn't direct in front of his eyes ..