Is it generally acceptable to use a primary key as a the id of an HTML element?

Question

I have an HTML list whose <ul> items have ids same as the primary keys in the database table. Is it generally acceptable to expose the primary keys for this purpose? If not, what efficient methods can be used to mask them?

Answer 1

ID's should not start with numbers.

http://www.w3schools.com/tags/att_standard_id.asp

If you can add something to it, really shouldn't be a problem. Security wise, I don't think using the ID is enough of a risk to worry about.

Answer 2

I've seen many people using this strategy, and I think it works quite well. You can 'obscure' the ids if you want to, but what is your security issue?

Answer 3

Using the primary id's is entirely fine unless you don't want to expose the ID's due to security reasons

Answer 4

What is the penalty for exposing database keys to the user? If there is none, then go ahead and expose them. If there is a penalty (usually indicating bigger security issues), then you can encrypt them.

(you might find it instructive to look at the page source for SO)

Answer 5

There's generally no problem with this, if your site is otherwise secure. Anyone who can access a primary key shouldn't be able to do anything with that knowledge. If you're relying on them being a secret, that's security through obscurity, which isn't much security at all.

However, if your primary keys are numeric, they are not valid element IDs. Element IDs must begin with a letter (src). You can do, e.g.

<span id="foo-<%= Model.PrimaryKey %>"></span>

Answer 6

No security measures are 100% fireproof. All else being equal, having multiple layers of security is better than a single one. Whether it's worthwhile to spend time obfuscating or encrypting the IDs depends on how valuable your data is, and therefore how determined any hackers are likely to be. In other words, how much would it hurt your company if the database were compromised?

However I think if someone gained enough access to your db that they were able to run queries against it that could take advantage of a primary key, they probably could run queries that could expose primary keys. So obfuscating keys is more likely to slow hackers down than stop them.

Still, it doesn't hurt to obfuscate them, as long as you make sure the obfuscated strings are unique. And in order to be effective, you should make it difficult to derive the primary key from the obfuscated id.

Answer 7

I see a few people saying that "IDs can't start with a number", but actually that's not true anymore in HTML5:

http://mathiasbynens.be/notes/html5-id-class

So, if you use HTML5 (no reason not to), you won't have to worry about that.