I'm looking at the OWASP Data Validation page trying to figure out what they mean with the "Best Method" for "business rule validation". I quote them here:

Example - Scenario

  • You are to populate a list with accounts provided by the back-end system
  • The user will choose an account, choose a biller, and press next


Best Method

The original code emitted indexes rather than account names.

int payeeLstId = session.getParameter('payeelstid');

accountFrom = account.getAcctNumberByIndex(payeeLstId);

Not only is this easier to render in HTML, it makes validation and business rule validation trivial. The field cannot be tampered with.

The other (bad/acceptable) examples listed are dismissed since it is easy for the user to tamper with the parameters.

Why would a user not be able to tamper with the payeeLstId in the "Best Method" thus casuing the accountFrom to change? Are they no longer using a form? How does the user selection end up in the session? I find the example unclear.


This example doesn't prevent against changing the value intentionally because the explained functionality says that the user is allowed to set the payeeLstId parameter. However, the example provided does prevent against multiple attacks because the parameter is first cast to an int before being used to query for the account. By tampering I'm assuming OWASP means that the value can't be used to exploit the vulnerabilities listed (buffer overflows, XML injection, etc) in the Why this is bad section not setting the value to reference another account.

  • Thanks, I find it strange that they say "the field cannot be tampered with". – span Aug 20 '15 at 14:21
  • Yeah, I think it's poor wording on their part. – Justin Moore Aug 20 '15 at 14:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.