Question on the upload attachments process in a request form

Question

hi,
I have a question on the upload attachments process in a request form. I have 2 pages, one is a request form and the other is an attahment page
The request form let users fill the mandatory fields (e.g. name, email, address...) And in the form, there is a link (URL without submit) to the attachment page.
In the attachment page, users can upload the supporting file for their rquest. The file will be uploaded to APEX_APPLICATION_FILES view and then it will be copied it to a customized table (table A) and remove from the view.
When the users finish uploading files (i.e. the files are stored in table A), users need to press a "Done" button back to the request form to submit the form.
My question is:
As the request form is not yet submitted while the attached files are stored in table A, there is no request_id (request from table primary key generated in an Insert trigger after submission) is generated to tag with the files in table A. Is there any standard practice to do this?
What I am doing now is to generate a hidden value in sequence when user goes to the attachment page. The hidden value is stored in table A togehter with the files when uploading. When user goes back to the request form, the hidden value is passed back as session cache. When the request form is submitted, I make an update statement by using the hidden vaule in the Insert trigger to tag the request_id to the attached files in table A.
Is my way appropriate?
Thanks for advice.
cheers,
Pong

Answer 1

Pong,
Yes, this would work just fine. You may want to consider enabling session state protection so that your process is not succeptable to URL tampering, which would cause a user to change the value of the REQUEST_ID in the URL and potentially associate other attahments with their request.
Thanks,
Scott