Question

So I have this form and it is being submitted via AJAX and the form data is serialized. So in the backend when I receive this data via PHP, I am simply using parse_str on the data and serializing it again to be saved into the database.

So my question is, how can you sanitize data that is coming in via JS AJAX that is serialized? Do I have to break it apart and run each value through mysql_real_escape_string or is there an easier way?

Thanks for looking.

Answer 1

Never manipulate serialized data: any change in length will break it and make it impossible to unserialize.

If you were using a conventional form you’d do:

1. On the client-side send a stringified JSON via a hidden input field using JSON.stringify()
2. json_decode() on the server-side and you get an array you can sanitize like any other form data.
3. serialize() the sanitized array and save to the DB

If you are using JQuery AJAX and send a POST request, stages 1-2 are redundant, because you can pass a JSON object or an array to the data as-is and it’ll be automatically turned into a PHP object/array.