Question

I’ve looked up briefly about the problems of having a dynamically changing site via javascript or php. However, I’m not interested in url link-backs, getting Google to spider the site, or general url navigation. I will however, tend to those who do not use javascript through my site.

To the question, I am curious that if I were to implement a dynamically changing page using jQuery and Ajax, will that cause vulnerability problems with PHP in the way I am implementing it?

Example jQuery:

<script type="text/javascript">
  $(document).ready(function(){
      $("div#text").hide();
      $("div#text").fadeIn("slow");
      $("li#button").click(function(){
      var page = $(this).attr("page");
      $.ajax({
        url: page,
        success: function(contents){
            $("div#text").empty();
            $("div#text").hide();
            $("div#text").html(contents);
            $("div#text").fadeIn("slow");
        }
      });
    });
  });
</script>

Called PHP/HTML:

<h1>Hello</h1>
<?php /* Do mysql/secure things here */ ?>

If there are more efficient/standard ways of doing what I want, I’m open to suggestions. I am not a jQuery programmer by any means.

Answer 1

So long as your PHP script is correctly sanitizing any REQUEST variables before use (and not returning unencrypted sensitive data, of course), this approach should be fine. The input is coming from the page just as any other URL request or form input would.

Using Ajax doesn’t make the request any less secure than it would be otherwise.