I've performed some security trials. In each simulated attach
1. I've written an asp page
2. I've called it into my browser
3. I've downloaded the produced html code to my desktop
4. I've modified some html tag (the action parameter, to make it to point to the original asp page
and, usually, some hidden form control)
5. I've called the modified html page into my browser
6. I've submitted the form

Then I expected AspDb to perform some security control before to apply my database updates.
In most cases I've been pleased with AspDb behaviour, but there have been two trials which alerted
me.
In this mail I would like to write about the first one (a problem I can easily overcome in my code,
but himo, a dangerous behaviour).
Here's the asp code (let's call this page dbEditAddROFldsSecurityExample.asp)
<%
Set X=Server.CreateObject(&#34;ASP.db&#34
X.dbUnit = 101
X.dbDSN=&#34;nwind&#34;
X.dbSQL=&#34;Select EmployeeID,lastName , firstName , title from employees&#34;
X.dbEditFlds=&#34;lastName,firstName,title[Sales Representative]&#34;
X.dbEditAddROFlds=&#34;title&#34;
X.dbEditParams = &#34;TableName=Employees,BookMarkFlds=0&#34;
X.dbStartUp=&#34;editAdd&#34;
X.dbNavigationItem=&#34;bottom,add&#34;
X.ASPdb
%>

I don&#39;t want the user to change the title field. But I, as a user, did it!
Let&#39;s look how I did it.

I&#39;ve downloaded the produced add page html code, and I&#39;ve got something like this:

<CENTER><h3>Add a new record</h3></CENTER>
<CENTER><FORM NAME=EDFORM_101
ACTION=&#34;/aspdb/trials/dbEditAddROFldsSecurityExample.asp#ASPDB_101&#34; METHOD=POST >
<P><TABLE BGCOLOr=#ffffff cellspacing=5 border=0>
<TR><th BGCOLOR=#99CCFF>
<font color=#0000cc>Field</font></th><th BGCOLoR=#99CCFF >
<font color=#0000cc>New Record</font></th></TR>
<Tr><th align=right BGCOLoR=#99CCFF ><font color=#0000cc>LastName &nbsp;</font></th>
<TD align=left><INPUT name=&#34;LastName&#34; TYPE=TEXT MAXLENGTH=20 SIZE=20 VALUE=&#39;&#39;></TD></TR>
<Tr><th align=right BGCOLoR=#99CCFF ><font color=#0000cc>FirstName &nbsp;</font></th>
<TD align=left><INPUT name=&#34;FirstName&#34; TYPE=TEXT MAXLENGTH=10 SIZE=10 VALUE=&#39;&#39;></TD></TR>
<Tr><th align=right BGCOLoR=#99CCFF ><font color=#0000cc>Title &nbsp;</font></th>
<TD align=left>Sales Representative</TD>
<INPUT NAME=&#34;Title&#34; TYPE=HIDDEN VALUE=&#39;Sales Representative&#39;></TR>
<tr align=centeR><th valign=middle ROWSPAN=3 BGCOLoR=#99CCFF >
<A HREF=&#34;/aspdb/prove/sicurezzaDbEditAddROFlds.asp?aspDBBut_101=aspDBgoG rid::0&#34;>
<font color=#0000cc>Cancel</font></A>&nbsp;</th>
<td ROWSPAN=3 align=center valign=middle>
<INPUT TYPE=HIDDEN NAME=aspDBClick_101 VALUE=applyadd>
<INPUT TYPE=HIDDEN NAME=aspDBUnit VALUE=&#39;_101&#39;>
<INPUT TYPE=Submit NAME=aspDBEditBut_101 VALUE=&#39;Add New Record&#39;><br>
<INPUT TYPE=Reset VALUE=&#39;Reset&#39;></Td></tr></TABLE></CENTER></FORM>
<A NAME=ASPDB_101> </A>

Then I&#39;ve changed the ACTION attribute of the FORM element to something like
&#34;http://glauco/trials/dbEditAddROFldsSecurityExample.asp#ASPDB_101&#34;
and I&#39;ve modified the VALUE attribute of the hidden INPUT element
named &#34;Title&#34; to &#39;Vice President, Sales&#39;.
I called the obtained html file dbEditAddROFldsSecurityExample.htm and I put it on my desktop.
Then I loaded dbEditAddROFldsSecurityExample.htm into my browser, I inserted a dummy lastName
and a dummy name field values and submitted the form.
The new record was added, with the &#39;Vice President, Sales&#39; title,
while I was hoping for either an error message or the default value added or something like this.

I&#39;ve performed similar trials with the dbEditUpdateROFlds property, and it seems to work properly
(the added hidden field is not considered at all). AspDb worked well also when I tried, in a
similar way, to update a field not included in the dbEditFlds list.

On the contrary, I found dbEditDropFlds not to be so good, from the point of view of security, but
I&#39;m going to write a dedicated mail to this subject.

I hope I&#39;m missing something, and there is a simple solution to theese apparent problems.

Thanks in advance for any hint.