Parameter passing

If you want to pass parameters between Web requests, you can use hidden fields on forms, URL parameters, cookies, or a combination of each technique. Each technique has pros and cons. Hidden fields only work on forms, URL parameters are visible to the end user, and cookies are not allowed by some users.

The simplest way to pass many parameters between Web requests is to use the database. You pass a unique identifier for each user or session between requests, and use this as a key into a "state" table held in the database. This technique requires that only a small token be passed between requests, as the majority of the data is safe and secure in the database.

Do not pass the unique identifier in plain text. Doing so makes it very easy for an end-user to change the value (even in hidden fields or cookies) and become someone else. Use code, similar to the code shown below to prevent people from changing the unique identifier, unless they know the hidden words, in this case "Web" and "Speed."

/* This code assumes that the Unique ID will not contain any colons (:). */
DEFINE VARIABLE vToken AS CHARACTER NO-UNDO.
DEFINE VARIABLE vUniqueID AS CHARACTER NO-UNDO.
/* WebEncode function */
FUNCTION WebEncode RETURNS CHARACTER (pUniqueID AS CHARACTER):
RETURN pUniqueID + ":" + ENCODE ("Web" + pUniqueID + "Speed").
END.
/* Use this to encode the Unique ID, then pass as parameter */
vToken = WebEncode (vUniqueID).
/* Use this to decode the token passed as a parameter. */
vUniqueID = ENTRY (1, vToken, ":").
IF vToken = WebEncode (vUniqueID) THEN
/* vToken has not been modified */
ELSE
/* ERROR - vToken has been modified */