Any sensitive data passed to the client and returned in a subsequent request needs to be verified before it is used to make access control decisions.
<form method="POST" action="search"> Please enter your search term: <input type="text" name="search"> <input type="hidden" name="role" value="admin"> <input type="submit" value="Search"> </form>