Question

Ok guys, So I know this has been covered before, but what my question strictly relates to is the security of doing such a thing. I have a page that is mostly generated by PHP functions which are on in a class in a separate file. my page calls…

<div class="transferfunds">
<?php dashboardFunction::buildPickers($uid); ?>
</div> 

like so and my PHP function is (obviously abbreviated)…

function buildPickers($uid){
$user =& JFactory::getUser();
}

now, what I’d like to happen is, it loads specific content on load, but when a user interacts with something specific(say a drop down) I’d like to use AJAX to call this function again and reload that specific div.

I get I could pass a variable through ajax and call tat function like…

    $.ajax({
        type : 'POST',
        url : 'post.php',
        dataType : 'html',
        data: {
            dataTest : 'test'
        },
        success : function(data){
                 $('#div').html(data);
        },
        error : function(XMLHttpRequest, textStatus, errorThrown) {

        }
    });

and test for it in php like so…

if(isset($_POST['dataTest']) && !empty($_POST['dataTest'])) {
 dashboardFunction::buildPickers($uid);
}

But A. would this work for sure, and B. would this actually be safe? Is it vulnerable to any type of injection etc.? thanks!

Answer 1

I assume that you’ll be passing user credentials this way, am I right? If so, this method is not very secure. It would be better to rely on a user session to share user data between scripts.