0

I'm trying to write a Bank Application. In the Transaction Page, I want to take the value of CheckingAccountId from the User Accounts Database (User.Identity.GetUserId()). But, how should I assign the value of User.Identity.GetUserId() to CheckingAccountId. This is the relevant Razor View Page Code:

using (Html.BeginForm("Deposit", "Transaction", FormMethod.Post, new { 
@class = "form-horizontal", role = "form" }))
{
    @Html.AntiForgeryToken();
    <h4>Deposit Section</h4>
    <hr />
    @Html.ValidationSummary("", new { @class = "text-danger" })
    <div class="form-group">
        @Html.LabelFor(m => m.Id, new { @class = "col-md-2 control-label" })
        <div class="col-md-10">
            @Html.TextBoxFor(m => m.Id, new { @class = "form-control" })
        </div>
    </div>
    <div class="form-group">
        @Html.LabelFor(m => m.TransactionAmount, new { @class = "col-md-2 control-label" })
        <div class="col-md-10">
            @Html.TextBoxFor(m => m.TransactionAmount, new { @class = "form-control" })
        </div>
    </div>

    <div class="form-group">
        @Html.LabelFor(m => m.CheckingAccountId, new { @class = "col-md-2 control-label" })
        <div class="col-md-10">
            @{
                var userName = User.Identity.GetUserName();

            }
            @*THIS IS THE BEST I COULD DO. I NEED HELP HERE*@
            @*@m.CheckingAccountId = userName*@
            @Html.DisplayName(userName)**

        </div>
    </div>
    <div class="form-group">
        <div class="col-md-offset-2 col-md-10">
            <input type="submit" class="btn btn-default" value="Deposit" />
        </div>
    </div>

UPDATE: I just found out that we can achieve this by adding the same in the ConnectionString when writing the SQL Query for pushing the transaction into the database. The solution would look something like this:

INSERT INTO table ( checkingaccountid, model_data ) VALUES ( $id, $data );

But I would still like to know if it's possible to send this id from the form when submitted along with the other data.

Mike Brind
  • 28,238
  • 6
  • 56
  • 88
Venkatesh Gunda
  • 41
  • 1
  • 4
  • 1
    Why would you want to include the value in your form (a malicious user could just change it to anything). You set the value in the POST method immediately before you save the record. –  Nov 11 '18 at 03:38
  • It is best to keep secret codes within the premises of your PostMethod. Like Stephen outlined, it is not recommended to let a malicious user to intercept your requests. – Ashokan Sivapragasam Nov 12 '18 at 11:29
  • Thanks Ashokan. Based on your suggestions, the data is now bound during the UPSERT Step to the Database through SQL Query – Venkatesh Gunda Nov 27 '19 at 10:57

0 Answers0