I have a website where I would like to use AJAX. I’m using mootools and as example use the following script:
$('some_element').addEvent('click', function() {
var myRequest = new Request.HTML({
url: 'example.php',
method: 'get'
}).send('action=remove&id=100');
});
The request is send to example.php which in turn will remove something from the database. The goal is that only logged in webusers from certain usergroups are allowed to remove these particular records. At the moment I don’t know how I can secure this / verify if the request is allowed. I could secure the page containing the Javascript code, but if for some reason somebody with bad intentions learns out about the example.php file, he could remove records without being authorised by just loading "example.php?action=remove&id=100" directly into his browser. I’d like to know if it’s possible to validate a request in example.php even tho it’s an AJAX request.
The only check I’m using now is:
if (isAjax() !== true) {
die();
}
function isAjax() {
return (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && ($_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest'));
}
But this can be bypassed if you know what you’re doing and still doesn’t tell me if the person initializing the XMLHttpRequest is in fact a valid webuser.
I’ve been searching for a while now and don’t seem to be able to find an answer for the following. Hopefully somebody can tell me more about this subject.
☆ A M B ☆
☆ A M B ☆