Why do people store variables in hidden form-inputs instead of acessing variable later?

Question

Why does people store variables like this:

<input type="hidden" name="id" value="<?php echo $bookid; ?>">

Instead of just accesing the $bookid when it's needed?

Is there any security breaches with this? I thought you could acess and change the value of an input with developer-tools? Not making it safe to store them there.

Answer 1

Apart from the whole client versus serverside thing, the security 'issue' should be non-existent. If someone does make a page with a 'hidden' form field to really hide it from the user as in, the user should never be able to find out the contents, that someone is "going to have a bad time".

The point of hidden fields is to hide them not for security, but because the user doesn't need it. Random example: Maybe I need to store the id of the Album you are looking at. You don't need to know that, why would you want to know that. But finding out I call this Album 2134125 in the back-end doesn't matter. Even if you change it, the only thing that will happen is you have just selected (bought, started to listen to, whatever your site does) a different Album. Unsellable albums, price, all stuff like that should be based on the ID, not on other stuff, so you can't hack it, you just confused yourself.

If you do need secure hidden fields there is an option btw: Sometimes we need to send actual data in hidden fields that we don't want to change. This is true for some payment providers where you actually send the amount a person needs to pay from a hidden field. (I'm not making this one up). This is usually securty by adding a second hidden field with a form of hash. This is made with a secret known to the payment provider and the server, but not available in the form. If you do some hash, say sha1(hiddenvalue + secret), add it, and compare after sending the form, you will get a different has (so no equality, so an error) if the hiddenvalue was changed.

Answer 2

You are mixing things. $bookid is PHP variable, only visible in the server. It is stored in the hidden form so it can be used by the browser (either by Javascript, by a new request to the server, or both). $bookid is invisible in the client side, it will be replaced by its value before leaving the server.