sugan Posted March 20, 2007 Share Posted March 20, 2007 Hi, I am having a site and in that site a page contains AJAX code. A javascript function has a HTTP request to another page with some arguments in the url, the server page gets the values from the url and insert them to the database.Someone had looked at my code and then hacked that to enter wrong values into the database.he directly called the javascript function from the location bar itself.How should i prevent this??Regards,Suganya Link to comment Share on other sites More sharing options...
aspnetguy Posted March 20, 2007 Share Posted March 20, 2007 you could send the data through hidden fields in a form via POST.Without seeing the code it would be hard to guess how to improve it. Link to comment Share on other sites More sharing options...
iyeru42 Posted March 21, 2007 Share Posted March 21, 2007 you could send the data through hidden fields in a form via POST.Without seeing the code it would be hard to guess how to improve it.Yeah, but the users could be smart enough to view the source code. Link to comment Share on other sites More sharing options...
aspnetguy Posted March 21, 2007 Share Posted March 21, 2007 Yeah, but the users could be smart enough to view the source code.I wouldn't matter if you checked the referrer before processing the data. If it did not come from the correct referrer then don't process it. Link to comment Share on other sites More sharing options...
Andrew K. Posted March 22, 2007 Share Posted March 22, 2007 Why not just sanitize the input from the server side before putting it in the database? Link to comment Share on other sites More sharing options...
aspnetguy Posted March 22, 2007 Share Posted March 22, 2007 Why not just sanitize the input from the server side before putting it in the database?That is a given no matter what other measures you take, you should always validate data to make sure it is safe and what is expected before executing it or entering it in the database. Link to comment Share on other sites More sharing options...
Andrew K. Posted March 22, 2007 Share Posted March 22, 2007 That is a given no matter what other measures you take, you should always validate data to make sure it is safe and what is expected before executing it or entering it in the database. I completely mis-understood what he wrote, I've been doing that quite alot lately... Link to comment Share on other sites More sharing options...
midnite Posted March 27, 2007 Share Posted March 27, 2007 i prefer checking the referrer. But can ajax retrieve the referrer? i bet not. So you should do the validation again in the server side. It add loads to your server, but it seems to be the only choice Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now