While your 2nd options isn't necessarily safe (you could change the query string and force things to run that you don't want run), here's a way to do it:
You can use reflection to load an instance of the class specified and then invoke the method specified. Of course, you'll run into a problem if you need to have the class already instantiated and in some certain state before you make the necessary call. For this you'll probably need to use the first option of session. I don't see using the session as "not the proper way". This kind of thing is what session is intended for. Just be careful how you use it and be sure to clean up after the use of the data otherwise you might end up chewing up lots of memory quickly.
I think the first option is best. Load the data into session then use it from there in the popup. This would be more secure and generally simpler to write.
-Peter
|