0

I have a preference center that is also accessible from the homepage (non-cloudpage) via an email entry form. When that form passes through and returns a valid record, it fills out the subscriber's info. I'd like to mask PII fields with ***** ****** or Kat** S***** similar to that of a type=password field.

Here's the question: Can I just change over the types of the input fields to password? In doing so, when the subscriber changes their email preferences/interest (non-PII fields), will the form pass through the starred values or will it pass through the original data extension value, or whatever they've updated that field to?

Improve this question

1 Answer 1

Reset to default
2

The password input field only obscures the presentation of the password. Within the field itself, the value is stored in plain text. So yes, you will be able to obscure the presentation, but in order to populate the field, you will need to pass the value in source code - revealing PII:

<input name="FirstName" type="password" value="John"/>

And since the values “behind” the scenes are still held in the form field as plain text, you will be able to pass them back into Marketing Cloud.

You will need to do some “tweaking” and return a value full of e.g. asterisks with same length as the actual value in your Data Extension. This transformation will need to take place in the AmpScript you use to retrieve your values. Result could be e.g.:

    <input name="FirstName" type="password" value="****"/>

Only if the submitted value differs from a row of asterisks, you can update your DE.

Improve this answer
7
  • That does answer the question, however, it someone toggles the type back to text, they'll be able to see it. Thinking of using placeholder substring with the first letter/number revealed. I think it's a mix of substring, replace and concat. Thoughts?
    – Tom Callahan
    Commented Feb 5, 2019 at 23:40
  • Hi Tom. This is exactly why I have put my second example there, where the value of the field is replaced by either asterisks or, if you prefer - a single letter and asterisks. Doing this in AmpScript instead of relying on front end is the only way of ensuring the content remains hidden.
    – Lukas Lunow
    Commented Feb 6, 2019 at 5:08
  • It's still of type="password" though? I guess I was under the impression that the HTML handling defaulted to straight **** without customization.
    – Tom Callahan
    Commented Feb 6, 2019 at 5:11
  • Well - here the field type is of course less important, as the plain text values never reach the source code of the page. My example is just to illustrate, that using type=password does not prevent the PII from being visible in source code - only replacing the string with placeholders, using backend (e.g AmpScript) does so.
    – Lukas Lunow
    Commented Feb 6, 2019 at 5:18
  • 1
    Ye, indeed. But you need to check, on form post, if new values differ from the ones with asterisks, before you upsert the given field
    – Lukas Lunow
    Commented Feb 6, 2019 at 5:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .