security question

[mrohad]

i've a page for user profile editing

my User has a currentMoneyAmount property.
in my JSF I show User.currentMoneyAmount as output text

this is a edit screen , I am outjecting the properties to some SB and do em.merge(editedUser)

can hacker or anyone else who knows seam make my page outject other properties as well like currentMoneyAmount?

[mrohad]

no one knows?

if I've <h:outputtext value="#{User.currentAmount}" />
can someone mess my html and outject this value to the server?

[gavin.king]

no

Do a "View > Page Source" in your web browser.