I'm looking at the OWASP Data Validation page trying to figure out what they mean with the "Best Method" for "business rule validation". I quote them here:

Example - Scenario

  • You are to populate a list with accounts provided by the back-end system
  • The user will choose an account, choose a biller, and press next


Best Method

The original code emitted indexes rather than account names.

int payeeLstId = session.getParameter('payeelstid');

accountFrom = account.getAcctNumberByIndex(payeeLstId);

Not only is this easier to render in HTML, it makes validation and business rule validation trivial. The field cannot be tampered with.

The other (bad/acceptable) examples listed are dismissed since it is easy for the user to tamper with the parameters.

Why would a user not be able to tamper with the payeeLstId in the "Best Method" thus casuing the accountFrom to change? Are they no longer using a form? How does the user selection end up in the session? I find the example unclear.

1 Answer 1


This example doesn't prevent against changing the value intentionally because the explained functionality says that the user is allowed to set the payeeLstId parameter. However, the example provided does prevent against multiple attacks because the parameter is first cast to an int before being used to query for the account. By tampering I'm assuming OWASP means that the value can't be used to exploit the vulnerabilities listed (buffer overflows, XML injection, etc) in the Why this is bad section not setting the value to reference another account.

  • Thanks, I find it strange that they say "the field cannot be tampered with".
    – span
    Aug 20, 2015 at 14:21
  • Yeah, I think it's poor wording on their part. Aug 20, 2015 at 14:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .