Why does a lookup to custom object on sites give invalid ID?

Question

I am developing an internal site for all company employees (basically an intranet). I am using a visualforce page but it must be externally available because not all company employees have a Salesforce license. One of the pages will be used for an internal competition.

I have a requirement to display a lookup field to a custom object. When typing in the lookup field and submitting the record, an invalid ID is passed to my controller. I'm assuming it's invalid because the field does not populate when the record is saved. When I grab the ID from the debug log and add it to my URL 'https://myinstance.salesforce.com/MyIDFromDebugLog' I get an Insufficient Privileges error.

When I click the lookup icon, and select the name of the record, I get a valid ID and the field is populated when the record saves.

How come when the user types a name in a lookup field on a force.com site, the ID is incorrect; however, when the user selects the record name from the lookup icon the ID is correct?

My Code:

<apex:inputfield value="{!Lead.my_field__c}" id="myField" onchange="javascript:getField('{!$Component.lc}_lkid')"/>

function getField(field) {    
    f = document.getElementById(field).value;
}

I suspect it has something to do with the onchange event in my input field.

Update

I found a great article by @Daniel Ballinger that explains the invalid ID. The invalid ID in my debug log('000000000000000AAA') is the empty key for relationships where there is no target record.

Reference: https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=0CB8QFjAA&url=http%3A%2F%2Fwww.fishofprey.com%2F2011%2F06%2Fsalesforce-empty-key-id.html&ei=9vUvVfDmD4mhNt-hgdgF&usg=AFQjCNG7WWCdjErbVyxYNojvPmlhj8Ra1Q&sig2=mSBD7KJ-MVyZfVJAnJt6gg

Is there a way to force the lookup field to search for the record once the user has entered a string?

Answer 1

Make sure the site has access (both CRUD permissions and Sharing Rules) to any object and field that the site touches. You can do this through the Sites Permissions. The site acts as a guest user in this case, and the guest user doesn't have the proper permissions to look at your record.

Obviously, be extremely careful here. You are exposing your database to the 'public' (i.e. anyone that has access to this site).