At 9:41 AM -0400 8/6/10, Marc Guay wrote:
Hi folks,

I'm looking for a straightforward way to protect PHP files which are
called via AJAX from being called from outside my application.
Currently, someone could forseeably open the console and watch the
javascript post variables to a public file (actions/delete_thing.php)
and then use this knowledge to trash the place.  I found this thread
at stackoverflow which seems to cover the issue I'm looking at, but
it's pretty intense and I figure there's an easier way but I'm not
sure how.

It seems unlikely that this is the method everyone uses, but maybe
not.  Advice is nice.


The logic should go like this.

Your initial PHP script [1] first generates a form that employs an AJAX script to trigger the slave PHP script [2], right?

If so, then have script [1] generate a unique token and place it in a SESSION, such as:

$_SESSION['token'] = $token.

Then have the PHP generated HTML form include a hidden input statement, such as:

<input type="hidden" name="token" value="<?php echo($token);?>" >

Note, the "hidden" isn't providing any security -- it simply means that the value isn't printed to the browser window.

Then have the slave PHP script [2] check the value in the $_SESSION['token'] with the value provided by the form. If the two match, then everything has been done via your server.




PHP General Mailing List (
To unsubscribe, visit:

Reply via email to