Privilege Escalation

For instance, consider an HTML form that writes out access control information in a hidden form field.

<form method="POST" action="search">
  Please enter your search term:
  <input type="text" name="search">
  <input type="hidden"
         name="role"
         value="user">
  <input type="submit" value="Search">
</form>