solved hidden field risk. still using a hidden field, but now with adId instead of receiverId