I have not worked with web technologies , so this may seem like a naive question.
I am trying to fix one of the issues on our webpages, this page is responsible for creating and sending an e-commerce transaction to sagepay. The problem is , all the fields it has are filled via _GET variable; which a user can easily modify on the URL before a transaction is actually made. An option would be to go via _POST, but it is still possible to modify and avert actual charges.
Hence i am looking for a mechanism which can help me pass this variables securely across to another page or perhaps the same page even. I am considering using a database to temporarily store these values, but i would like to hear what is the optimal way of going about such a problem.