Well, that's not what binding is supposed to do. After all, field names aren't something you should be exposing at all. > I do an exact equality check against

Well, that's not what binding is supposed to do. After all, field names aren't something you should be exposing at all. > I do an exact equality check against a white list. Pretty much the way you are supposed to do it (except, I'd actually use the value in the white list rather than the matched input value, as the two should not be the same).