copy paste question

[mcnewsxp]

i just discovered while copying and pasting some text from a form that if ihi-lite an area that has hidden text-boxes the hi-lited area the contents of those hidden fields appears when i paste it. this may be old news to some of you, but this is not good news for me. i know there are other ways to pass info from one form to the next, but is there anyway to prevent this from happening?
tia,
mcnewsxp

 

[Neil Gould]

i just discovered while copying and pasting some text from a form
that if i hi-lite an area that has hidden text-boxes the hi-lited
area the contents of those hidden fields appears when i paste it.
this may be old news to some of you, but this is not good news for
me. i know there are other ways to pass info from one form to the
next, but is there anyway to prevent this from happening?

Not that I know of. Safest to presume that any information presented to a
browser will be available to the user.

 

[mcnewsxp]

i think i could make this work:

<script>
function disablecopypaste()
{
alert("Function Not allowed");
return false;
}
</script>
<input type="text" name="txtdemo"
oncopy=" return disablecopypaste();"
onpaste=" return disablecopypaste();"
oncut=" return disablecopypaste();"
/><br />

 

[Jonathan N. Little]

i think i could make this work:

<script>
function disablecopypaste()
{
alert("Function Not allowed");
return false;
}
</script>
<input type="text" name="txtdemo"
oncopy=" return disablecopypaste();"
onpaste=" return disablecopypaste();"
oncut=" return disablecopypaste();"
/><br />

And when JavaScript is disabled?

 

[Mayeul]

And when JavaScript is disabled?

In prevision to the next answer: it is perfectly possible to have
JavaScript enabled on the whole, but to disable some specific parts of
JavaScript in a website. Not easy for everyone, but easy for a web engineer.

So, no, "I will build the page entirely in JavaScript so that disabling
JavaScript won't work at all" is not a solution.
"What about disabling JavaScript" merely points out that the user can
give his browser orders that you can't override. With the easiest scenario.

 

[mcnewsxp]

we're using javascript elsewhere in our code. we haven't had any complaints. it's not a large user base and we have some control over how they access our site.

 

[Jonathan N. Little]

In prevision to the next answer: it is perfectly possible to have
JavaScript enabled on the whole, but to disable some specific parts of
JavaScript in a website. Not easy for everyone, but easy for a web
engineer.

So, no, "I will build the page entirely in JavaScript so that disabling
JavaScript won't work at all" is not a solution.
"What about disabling JavaScript" merely points out that the user can
give his browser orders that you can't override. With the easiest scenario.

It was a rhetorical question, but thanks for elaborating the problem
with his "solution" to poor Richard.

 

[mcnewsxp]

my solution won't work because you can't hi-lite what you can't see.

 

[Doug Miller]

i think i could make this work:

I think you can't.

How do you propose to stop me from invoking my browser's View Source
function?

Hint: even if you use JavaScript to disable the menu bar and the
(right-click) context menu, I can still see the source by pressing
Crtl-U in Firefox or Opera.

ANYTHING that is written to a browser can be viewed by the user.

 

[Doug Miller]

my solution won't work because you can't hi-lite what you can't see.

No, your "solution" won't work because you CANNOT prevent me from seeing
what you send to my browser.

 

[mcnewsxp]

yea, i realize that. but i won't be sending my user name and password to your browser.

 

[Denis McMahon]

No, your "solution" won't work because you CANNOT prevent me from seeing
what you send to my browser.

The web server doesn't even know what the browser is. It only knows what
the browser claims to be.

curl / wget with user agent spoofing, examine the source in the editor of
your choice at your leisure.

Rgds

Denis McMahon

 

[Jonathan N. Little]

yea, i realize that. but i won't be sending my user name and password to your browser.

If you put them in "hidden" fields you will be...

 

[mcnewsxp]

i won't be sending anything to you. i'll be logging on and navigating the site for my purposes. i won't be sending anybody anything. i think i justfigured out i don't need to worry about this. all anyone would ever be able to see is their own log-on creds. a cassandra moment i guess.