Question

Ok guys so a little background… I’m writing a small application that will assign points based on Facebook actions like sharing, posting etc. I have the concept and idea down but I want to make sure it’s a good experience and with that, I want to make in with alot of AJAX. My fear is that someone can manipulate my code with firebug etc. to trigger a function to assign points without the facebook API call.

so the logic would be like this…

$('.trigger').click(function(e){

//facebook call

//upon completion and validation ajax call

});

But with a console like firebug couldnt you manipulate this to just fire the second part? The response I recieve from the facebook call as far as I know is just things like ID of the post etc. I’d like to avoid keeping everything in PHP for usability reasons. Thanks!

Answer 1

Anything that is client-side can be manipulated. Period. There’s nothing you can do about it. The only way is to enforce your rules on the server.