FreeKB - MVC Exclude database columns from being updated
MVC - Exclude database columns from being updated

Let's use an example where you have a SQL table with Date_Created and Date_Updated columns. You also have a file in your MVC application at /Views/App/Edit, which produces a web page such as When submitting an update, only the Date_Updated column should be updated. One way to accomplish this is to use the HiddenFor HTML helper.

@Html.HiddenFor(model => model.Date_Created)


Because the Date_Created field is hidden, we cannot view or update the data in Date_Created when navigating to If we view the source of the web page, we should see something like this:

<input id="Date_Created" name="Date_Created" type="hidden" value="2016-01-01" />


However, using Fiddler, we will be able to update the Date_Created data in the database. You can download and install Fiddler from

  1. Launch Fiddler.
  2. In your MVC application, edit and save a record at your page.
  3. In the left panel of Fiddler, highlight the capture that has
  4. In the right panel of Fiddler, select the Composer tab.
  5. Drag the capture onto the right panel.
  6. In the Request Body area, replace Date_Created=2016-01-01 with Date_Created=1999-01-01.
  7. Select Execute.

Now, if we return to, Date_Created will display 1999-01-01. While kind of an innocent example when thinking about Date Created, this at least demonstrates a vulnerability when using the HiddenFor HTML helper. This vulnerability can be mitigated by excluding Bind properties.

In the /Controllers/ExampleController file in your MVC application, locate the public ActionResult Edit section, and modify this section to exclude the Date_Created column, replacing table_name with the name of your SQL table.

public ActionResult Edit([Bind(Exclude = "Date_Created")] Table_name table_name)


Now, if we view the page source, there is no markup for the Date_Created column. Also, Fiddler is unable to modify the Date Created data.


Add a Comment

We will never share your name or email with anyone. Enter your email if you would like to be notified when we respond to your comment.

Please enter f7b14 in the box below so that we can be sure you are a human.


Web design by yours truely - me, myself, and I   |   |