title: Is it unwise to have a static method be used for security validation in ASP.net?
body: <p>I have a static method like this</p>
  
  <pre><code>public static string DoSomethingToString(string UntrustedString)
  {
  //parse format and change string here.
  return newString.
  }
  </code></pre>
  
  <p>Since I know that multiple calls to:</p>
  
  <pre><code>static int myInt=0;
  public static int AddNumber()
  {
  lock(someObject)
  {
  myInt++;
  return myInt;    
   }
  }
  </code></pre>
  
  <p>will return an ever increasing number (that is shared among pages), I'm not sure how local the variables will be treated in DoSomethingToString();</p>
  
  <p>I'd like to learn the conditions in which a static method can safely/unsafely be used in ASP.net just to put my multi-threaded brain to rest on this topic.</p>
  
  <p><strong>UPDATE:</strong></p>
  
  <p>Most of the discussion has been around value types.  How do I know when it's safe to call methods  (explicitly or implicitly)  that change my reference types? Is it enough to looking at MSDN documentation and only use methods where it says "threadSafe"?</p>
  
  <p>One example if what I call an implicit change is using String.Split() since it's part of the same class.  I think there is a likelihood that some security characteristics are shared and there is less worry/diligence needed. (?)</p>
  
  <p>What I'm calling an explicit change (for lack of a better word right now) is calling another method to do work... which can be static or an instance class.  I think that more background/research work needs to be done to ensure that each object and method is ThreadSafe.</p>
  
  <p>For the sake of discussion assume I have a method with this signature: </p>
  
  <pre><code>ValidateStringAndContext(string untrustedString, Object myCustomUserContext)
  </code></pre>
  
  <p>and it has a static method that references the following object </p>
  
  <pre><code>public SecurityChecker
  {
  public static object CheckSecurityStatic(string DirtyData)
  {
  //do string.split
  //maybe call a database, see if it's a token replay 
  //
  
  //OR  - alternate implementation
  SecurityChecker sc = new SecurityChecker();
   if (sc.CheckSecurity(DirtyData))
    {
    myCustomUserContext.Property1 = new GUID()
    }
  return myCustomUserContext;
  }
  
  
  public class bool CheckSecurity(string DirtyData)
  {
  //do string.split
  //maybe call a database, see if it's a token replay 
  // return true if OK return false if not
  }
  }
  </code></pre>
  
  <p><strong>Revised Question</strong></p>
  
  <p>Would I run into concurrency issues (variables overwriting each other) if the static "utilities" class I create were to create an instance of another object and then call the method --versus-- simply calling a static method directly?</p>