JS/jQuery security

Question

As a beginner, I'm always wondering if what I'm doing is actually secure. For example, recently I finished working on some code which checks how many times a (cross-domain) iframe has been clicked. And when clicked, inserting a row into a MySQL (log) table based on an ajax request(with jquery) which wraps the ID of the iframe into a $_POST:

$.ajax({ 
        url: 'execute.php',
        data: {action: 'some-id'},
        type: 'post'
    });

However I'm wondering: Because JavaScript is executed client-side, is it possible for a user to send fake data through the ajax request to the 'execute.php' page?

It absolutely is possible, that's why you should always check the data in your PHP code. — Kyle
– Kyle, Commented Jul 22, 2015 at 17:14
A client can completely ignore whatever your code does and send any arbitrary data to that endpoint. — Scott Arciszewski
– Scott Arciszewski, Commented Jul 22, 2015 at 17:39

jmar777 · Accepted Answer · 2015-07-22 17:13:39Z

2

is it possible for a user to send fake data through the ajax request to the 'execute.php' page?

Yes.

answered Jul 22, 2015 at 17:13

jmar777

39.8k11 gold badges68 silver badges66 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Mindastic · Accepted Answer · 2015-07-22 17:16:41Z

2

is it possible for a user to send fake data through the ajax request to the 'execute.php' page?

It is completely possible, you should add validations on the server.

For example, if i go to your site, open the console and write this code:

    $.ajax({ 
        url: 'execute.php',
        data: {action: '1'},
        type: 'post'
    });

It will send a request to your execute.php sending the info action=1.

answered Jul 22, 2015 at 17:16

Mindastic

4,1413 gold badges21 silver badges20 bronze badges

Collectives™ on Stack Overflow

JS/jQuery security

2 Answers 2

Comments

Comments

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Related