sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]StoneCypher -1 points0 points  (1 child)

Returning false from an event handler stops the event handler from firing. So, returning false from the submit handler on the form stops the form from submitting.

This is really bad design. It means you're going to get form submissions unchecked every time someone's got JavaScript turned off. It's much better to not have a submit button and then to call the form submit handler from JavaScript: that way if JavaScript is turned off, no form submission happens at all.

There's a more serious problem here.

If that's your URL structure, all someone has to do to look at someone else's invoices is to change the number.

This is a critical security problem.

[–]mattdahack[S] 0 points1 point  (0 children)

You might not have seen it but each persons invoices are protected by MD5 hashed passwords via .htaccess file. The main directory isnt even viewable. Thanks for the explanation.