I'm looking at the OWASP Data Validation page trying to figure out what they mean with the "Best Method" for "business rule validation". I quote them here:
Example - Scenario
- You are to populate a list with accounts provided by the back-end system
- The user will choose an account, choose a biller, and press next
The original code emitted indexes rather than account names.
int payeeLstId = session.getParameter('payeelstid');
accountFrom = account.getAcctNumberByIndex(payeeLstId);
Not only is this easier to render in HTML, it makes validation and business rule validation trivial. The field cannot be tampered with.
The other (bad/acceptable) examples listed are dismissed since it is easy for the user to tamper with the parameters.
Why would a user not be able to tamper with the
payeeLstId in the "Best Method" thus casuing the
accountFrom to change? Are they no longer using a form? How does the user selection end up in the session? I find the example unclear.