web programming technique, is this a major security risk?

Question

I've found this technique to be interesting to short some coding time. Not having to re-create database related statements along with a form binder for webcontrols is indeed interesting in my opinion. But I was wondering if it should be considered a major security risk for non intranet projects because it shows the database structure to the users

http://www.ironpythonresource.com/post/2008/08/23/IronPython-Dynamically-creating-objects-and-binding-them-to-a-form.aspx

Now I know this question might not have an unique purely objetive answer, but I hope tagging it as subjetive and making it comunity wiki it's enough for it to remain open and getting some technical considerations about it

Answer 1

That way of determining the data fields to change from the form data can definitely be a security risk.

Say that I have a User table that has an IsAdmin field to determine who has full access to the application. In the form where a user can edit their own information the IsAdmin field is of course not included, but by simply editing the page before posting it (using for example FireBug), they can easily add a form field with that name what will automatically populate the property in the object. All they need to know (or guess) is what to name the field and what to put in it. Voila, we have another admin!