Should I store a database ID field in ViewState?

Question

I need to retrieve a record from a database, display it on a web page (I'm using ASP.NET) but store the ID (primary key) from that record somewhere so I can go back to the database later with that ID (perhaps to do an update).

I know there are probably a few ways to do this, such as storing the ID in ViewState or a hidden field, but what is the best method and what are the reasons I might choose this method over any others?

Answer 1

Session["MyId"]=myval;

It would be a little safer and essentially offers the same mechanics as putting it in the viewstate

Answer 2

ViewState is an option. It is only valid for the page that you are on. It does not carry across requests to other resources like the Session object.

Hidden fields work too, but you are leaking and little bit of information about your application to anyone smart enough to view the source of your page.

You could also store your entire record in ViewState and maybe avoid another round trip to th server.

Answer 3

I personally am very leery about putting anything in the session. Too many times our worker processes have cycled and we lost our session state.

As you described your problem, I would put it in a hidden field or in the viewstate of the page.

Also, when determining where to put data like this, always look at the scope of the data. Is it scoped to a single page, or to the entire session? If the answer is 'session' for us, we put it in a cookie. (Disclaimer: We write intranet apps where we know cookies are enabled.)

Answer 4

It depends.

Do you care if anyone sees the record id? If you do then both hidden fields and viewstate are not suitable; you need to store it in session state, or encrypt viewstate.

Do you care if someone submits the form with a bogus id? If you do then you can't use a hidden field (and you need to look at CSRF protection as a bonus)

Do you want it unchangable but don't care about it being open to viewing (with some work)? Use viewstate and set enableViewStateMac="true" on your page (or globally)

Want it hidden and protected but can't use session state? Encrypt your viewstate by setting the following web.config entries

<pages enableViewState="true" enableViewStateMac="true" />
<machineKey ... validation="3DES" />

Answer 5

I tend to stick things like that in hidden fields just do a little

 <asp:label runat=server id=lblThingID visible=false />

Answer 6

If its a simple id will choose to pass it in querystring, that way you do not need to do postbacks and page is more accessible for users and search engines.

Answer 7

Do you want the end user to know the ID? For example if the id value is a standard 1,1 seed from the database I could look at the number and see how many customers you have. If you encrypt the value (as the viewstate can) I would find it much harder to decypher the key (but not impossible).

The alternative is to store it in the session, this will put a (very small if its just an integer) performance hit on your application but mean that I as a user never see that primary key. It also exposes the object to other parts of your application, that you may or may not want it to be exposed to (session objects remain until cleared, a set time (like 5 mins) passes or the browser window is closed - whichever happens sooner.

View state values cause extra load on the client after every post back, because the viewstate not only saves objects for the page, but remembers objects if you use the back button. That means after every post back it viewstate gets slightly bigger and harder to use. They will only exist on he page until the browser goes to another page.

Whenever I store an ID in the page like this, I always create a property

public int CustomerID {
    get { return ViewState("CustomerID"); }
    set { ViewState("CustomerID") = value; }
}

or

    Public Property CustomerID() As Integer
        Get
            Return ViewState("CustomerID")
        End Get
        Set(ByVal value As Integer)
            ViewState("CustomerID") = value
        End Set
    End Property

That way if you decide to change it from Viewstate to a session variable or a hidden form field, it's just a case of changing it in the property reference, the rest of the page can access the variable using "Page.CustomerID".