At 9:41 AM -0400 8/6/10, Marc Guay wrote:
I'm looking for a straightforward way to protect PHP files which are
called via AJAX from being called from outside my application.
Currently, someone could forseeably open the console and watch the
and then use this knowledge to trash the place. I found this thread
at stackoverflow which seems to cover the issue I'm looking at, but
it's pretty intense and I figure there's an easier way but I'm not
It seems unlikely that this is the method everyone uses, but maybe
not. Advice is nice.
The logic should go like this.
Your initial PHP script  first generates a form that employs an
AJAX script to trigger the slave PHP script , right?
If so, then have script  generate a unique token and place it in a
SESSION, such as:
$_SESSION['token'] = $token.
Then have the PHP generated HTML form include a hidden input
statement, such as:
<input type="hidden" name="token" value="<?php echo($token);?>" >
Note, the "hidden" isn't providing any security -- it simply means
that the value isn't printed to the browser window.
Then have the slave PHP script  check the value in the
$_SESSION['token'] with the value provided by the form. If the two
match, then everything has been done via your server.
http://sperling.com http://ancientstones.com http://earthstones.com
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php