Question

I allow my users to favorite an update or a forum topic.
So when a user tries to favorite one of these i will send via Ajax 2 things, the item_id(update or topic) as id(ex. 1321313213) and its type(“update” or “topic”) as string.

However lets say someones tries to favorite an update with the id untouched but the type is changed to “topic”(via firebug or whatever else)…

This should not procceed since this combination is not correct… how can i assure that the item_id being sent is an update or a topic since this ID might co-exist in both tables???

Current solution:

Create a hidden input element and add as value 5 random characters (a-zA-Z0-9) and md5 type name(update or topic)

like:

$random_str = $this->my_model->generateRandomString(5);
<input type="hidden" value="<?php echo $random_str.md5("update"); ?>" id="type" />

so when i try to validate the data to check if it is an update or topic i split the type on the first 5 characters and later and check if the later characters are md5 hashed are update or topic and continue validation

I would like some help in case this can be altered as well…

Answer 1

Your server side script (PHP) must always assume it’s getting bogus data. Never rely solely on javascript to handle any sanitization / verification.

If your javascript can determine if the job should be “update” or “topic”, I’m sure your PHP can do that as well. Probably using a few more DB queries or some such, but that’s the price you’ve got to pay.