Hidden Field being set with data from another website

Question

I have a very interesting situation and I'm just looking for ideas at the moment. I have a webpage for insurance agents that the agent will login and then enter some insured information.

There is a field named "agentnumber" that is on the form, but is hidden by a display:none. The field is set from the username of the person who logs in whenever the form loads the first time. The form will save automatically when the user leaves the page.

I am experiencing a weird issue that every now and then, the agentnumber field is getting saved with incorrect data. After discussing it with the agent, it is being saved with the agentnumber of the agent from other companies, not from the my website. Just looking for any ideas on what may be happening as I thought browser security would prevent cross site javascript. The users are using IE 7 & IE 8. Any help would be appreciated as I'm not even sure what to look for.

Answer 1

I would suspect that it may be related to autocompletion. The field may be filled in by the autocomplete mechanism. A couple of suggestions I might make -- store the information in the session, not on the page, if at all possible. Using it from the page runs some risk that a malicious person might hand-code a response that puts the wrong information in this field intentionally. If that's not a real issue or it's not possible to use the session, then make the field of type hidden. These fields are not filled in automatically by autocompletion.