Validation of URL parameters

Question

I would like opinions on an issue, perhaps even simple, just to know more ways to do it. The situation is as follows:

NOTE: I use in this example . Net Framework 4.0 with a lot of Javascript, I only use Code-Behind to catch the QueryStrings and store them in input hidden's, all business rule is made in a web service (.amx).

01- You send an id = 1 to an editing page by clicking on the link.

< a href="http://site/editar.aspx?IdPessoa=1" >Editar< /a >

02- On the page edit.aspx through Code-Behind you play in a input hidden (txtIdPessoa):

this.txtIdPessoa.Value = (Request.QueryString["IdPessoa"] ?? string.Empty).Trim();

03- On this page edit.aspx has the other fields for editing the person. After the person fills in all fields he will save, done through jquery ajax, sending values to a method (SalvarDados()) of a web service:

$("#btnSalvar").click(function(){
        $.ajax({
            type: "POST",
            url: "http://site/WebService1.asmx/SalvarDados",
            data: "{'idpessoa':'" + $("#txtIdPessoa").val() + "','nome':'" + $("#txtNomePessoa").val()  + "'}",
            contentType: "application/json; charset=utf-8",
            dataType: "json",
            success: function (resposta) {
        alert("Sucesso");
            },
            error: function (xhr, msg, e) {
        alert("Erro");
            }
        });
});

04- But you can take a swindle there, if before clicking save you enter in the url the code below:

javascript:$("#txtIdPessoa").val("2");

05- When saving, you will edit to someone else, from Id = 2, doubt is how to store this IdPessoa, without being altered in this way? How do you use?

06- There are validations on client and server, here I just posted in a simple way, the problem is that this script does not refresh on the page.

Answer 1

1 - I would use GUID instead of INT, only this would solve all the problems.

2 - If you save in Sesssion or Viewstate, the user cannot change in Client.

Session["Idpessoa] = Request.Querystring["Idpessoa"];

3 - Pass SESSION value and not Hidden input.

4 - If you are in Session/Viewstate you cannot change.

5 - I don’t understand

6 - I didn’t understand very well.