Using SQL queries in ajax

Question

Is there anything wrong with just using a SQL query in an ajax call? For example something like:

$.ajax({
     type: "POST",
     url: "queryhandler.php",
     data: { query: "INSERT INTO users VALUES(incontrol, drowssap)" },
     dataType: "json",
     success: function (data) {
         if (typeof callback == 'function')
             callback(data);
     }
);

Is this unadviced? If it is, why?

No, other than i can change that query to DELETE FROM users in the console. — Kevin B
– Kevin B, Commented Sep 6, 2012 at 15:55
except that some not even very good hacker can destroy data in your DB - no — Ivan Hušnjak
– Ivan Hušnjak, Commented Sep 6, 2012 at 15:55
As long as you're ok with the glaring security problems, there's nothing wrong with it. — Anthony Grist
– Anthony Grist, Commented Sep 6, 2012 at 15:56

Lusitanian · Accepted Answer · 2012-09-06 15:56:30Z

3

This is a very bad idea. If you can make a direct SQL query from AJAX, which is a client-side technology than anyone who uses your website can. If you return results, this means that not only can everyone on your site add/remove/modify data and potentially manipulate table structure, but they can also extract private or confidential data from your database.

answered Sep 6, 2012 at 15:56

Lusitanian

11.1k1 gold badge43 silver badges38 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Daniel M · Accepted Answer · 2012-09-06 15:58:10Z

1

Yes, for several reasons.

a. You provide a direct interface to any "hacker" to read and manipulate your data.

b. Even if you add a whitelist on the server-side that filters out manipulated queries, you'd expose your database structure (or parts of it) which can help attackers to be more targeted.

answered Sep 6, 2012 at 15:58

Daniel M

3,38922 silver badges30 bronze badges

Comments

dipmala · Accepted Answer · 2012-09-07 12:38:58Z

0

Yes this is wrong because you are inviting hackers to come at your site and hack your website.

answered Sep 7, 2012 at 12:38

dipmala

2,0111 gold badge16 silver badges17 bronze badges

Collectives™ on Stack Overflow

Using SQL queries in ajax

3 Answers 3

Comments

Comments

Comments

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Related