How to create safe scripts PHP + jquery

Question

From my phpwebsite, when users need to create a new post (for example), I'm sending a jquery/post to one phpscript to do this action. But this is not safe, I mean, everyone could send a fake jquery/post to that script with the same user id with no login requirement.

Is it any safe way to do this?

SLaks · Accepted Answer · 2013-01-07 15:49:14Z

2

Don't include the user ID in the POST.

Instead, just use the ID of the currently-logged-in user on the server.

This assumes that you have a secure way to track login sessions.

answered Jan 7, 2013 at 15:49

SLaks

891k182 gold badges1.9k silver badges2k bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Ksakser Over a year ago

So, I have to startsession and do authentification on each script, right?

SLaks Over a year ago

@Ksakser: Yes. You should always do that for any non-anonymous operation.

mpaepper · Accepted Answer · 2013-01-07 15:47:56Z

0

You could submit the userId of the current user. Then in the PHP script check the session and evaluate that the userId which is sent is the same as the user id of the logged in user.

answered Jan 7, 2013 at 15:47

mpaepper

4,0324 gold badges23 silver badges29 bronze badges

Collectives™ on Stack Overflow

How to create safe scripts PHP + jquery

2 Answers 2

2 Comments

Comments

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Related