Thanks for the link to your blog euromark. It helped me a lot and I now see my question as solved.
@ohacibi: i don't think you're approach does fix the problem I described. You could still add an arbitrary field and send it to the server. 2010/9/21 ohcibi <i...@dwgadf.de> > THE normal approach is go generate an id and include it as hiddem > field in your Formsache. Ic this field is Mission or has a wrong value > you'll know that the form data came from a wrong place > > On 20 Sep., 16:11, rethab <rethab...@gmail.com> wrote: > > hi there > > > > I have the following (simplified) scenario: A usual form to add a post > > (from the blog tutorial). If the form is submitted, this method is > > called inside the action: $this->Post->save($this->data); > > I also have some validation stuff inside the post model (title, body). > > > > Now I know, anybody can submit any data to my server, e.g. a variable > > called data[Post][id] additionally to the usual form data. What > > happens now? The post is actually inserted with the submitted id! By > > the way, this could override an existing post ;) > > > > So what I did is, I added a validation criteria to the post model > > which forces the id to be empty. This causes the post not to be > > validated and can therefore not be saved. > > > > It does work as expected, but is that the official way to prevent from > > arbitrary primary key "injection"? I don't want to check it inside the > > controller action. > > > > I'd appreciate if somebody could show me his/her solution to this or > > if there's even a standard way. > > > > Regards, > > rethab > > Check out the new CakePHP Questions site http://cakeqs.org and help others > with their CakePHP related questions. > > You received this message because you are subscribed to the Google Groups > "CakePHP" group. > To post to this group, send email to cake-php@googlegroups.com > To unsubscribe from this group, send email to > cake-php+unsubscr...@googlegroups.com<cake-php%2bunsubscr...@googlegroups.com>For > more options, visit this group at > http://groups.google.com/group/cake-php?hl=en > Check out the new CakePHP Questions site http://cakeqs.org and help others with their CakePHP related questions. You received this message because you are subscribed to the Google Groups "CakePHP" group. To post to this group, send email to cake-php@googlegroups.com To unsubscribe from this group, send email to cake-php+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/cake-php?hl=en
