Use of hidden fields should be avoided. Never include sensitive content in hidden fields. Ensure that hidden field values are validated if they are used.