Ben Forta

Hidden form fields are a great way to pass data back and forth while processing a multi-part form -but you must use these carefully. As they are form fields they are essentially strings within quotes. As such, you must make sure to never place a string containing quotes in a hidden field. If you do so your field will be truncated prematurely, you’ll lose form data, and the hidden information could even end up displayed on the screen. This is particularly important when you are using variables to populate hidden form fields (where the contents are dynamic and less controlled). (Applies to: ColdFusion All)