EDIT - fixed security issue, working with saved buttons - client validation for button id