Protecting a php when page loaded with jQuery's .load function

Question

My index page (index.php?profile=profilename_here) loads content into a div using jQuery's load() function in the normal fashion and all is working fine.

$().ready(function() {
    $('#details').load('pages/sidebar/details.php?profile=<?PHP echo $profile;?>').fadeIn(2000);
});

then in my pages/sidebar/details.php I have MySQL queries.

$result = mysql_query("SELECT * FROM public_profile WHERE username='$profile'") or die(mysql_error());

All the php stuff is secure and I am sanitising all varibales as I should be.... but if someone was to go to 'pages/sidebar/details.php?profile=' and change the profile name they will be bringing up other peoples details.

Is it possible to check if the page was loaded by .load() and if not, to stop the page from loading or scripts from executing?

Maybe you can use session so that your details.php would know if you're authenticated as the owner of the profile? — Damp
– Damp, Commented Mar 8, 2012 at 15:27
these are public pages and nobody has logged in to veiw these details — Ian Ditchfield
– Ian Ditchfield, Commented Mar 8, 2012 at 15:27
If the profiles are public and you don't have to be logged into see them, why does it matter if they pull up other profiles? — jprofitt
– jprofitt, Commented Mar 8, 2012 at 15:29
@IanDitchfield It most certainly does matter if your concern is security. — jprofitt
– jprofitt, Commented Mar 8, 2012 at 16:39

JKirchartz · Accepted Answer · 2012-03-09 15:24:13Z

3

If you only want to run code when the page is requested with ajax use

if ($_SERVER['HTTP_X_REQUESTED_WITH'] === 'XMLHttpRequest') { 
    /* run this if requested by ajax */ 
}

unfortunately this doesn't make it much more secure since anybody can use dev-tools like firebug to change that URL in the code. If you want only want the current user to see their own profile you can store $profile in the $_SESSION that way they don't have direct access to the URL parameter.

Check out OWASP's SQL Injection Prevention Cheatsheet for some methods to sanitize data, although I don't think anything there is PHP specific.

edited Mar 9, 2012 at 15:24

answered Mar 8, 2012 at 15:41

JKirchartz

18.1k8 gold badges64 silver badges89 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Ian Ditchfield Over a year ago

ok. thanks for your help. the code above was only added to explain my question. i'm pretty certain that i have the actual code sanitised and safe.

JKirchartz Over a year ago

Just to be safe, I added a link to OWASP's SQL injection prevention cheatsheet, I'm sure it'll help somebody out...

Collectives™ on Stack Overflow

Protecting a php when page loaded with jQuery's .load function

1 Answer 1

2 Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Linked

Related