AJAX Security - Sending Queries through AJAX

[electricshoe]

I'm working on building the AJAX half of my php application. I have a lot of query functions, that are great, but pose a big security risk with ajax.

I'm trying to figure out how to get around this, I'll use some much more basic stuff to illustrate the problem.

http.open("GET", index.php?q='INSERT INTO table (id) VALUES ('foo')', true);

Okay so that means the user has the means to put whatever query they want into index.php. POST is just as vulnerable if someone writes javascript to access your php files from an outside domain as well.

So how do sites get data from a database using ajax securely? No I don't actually pass full queries to my application, but I need to pass query parameters like id's. Do I need to create session variables to store all of the query data and then just pass the session key to the ajax, or what??

Thanks very much for your help and insight:)

[abduraooft]

Build your queries at your server-side based on variables&values send through AJAX and then execute it.

[A1ien51]

Security is no different than a normal postback model. You would not stick a SQL query in a hidden field, you ouwld post back what you need, filter the data, and build your SQL statement. Same thing should happen here.

Eric