/    Sign up×
Community /Pin to ProfileBookmark

php script to use with ajax

Hi,

I am just starting to play around with ajax and I have create a drag and drop table to alter the order of system.

I have the following code on the client side that loads my php file.

[CODE]
$(‘#admintable’).load(“/includes/ajax.php?type=gallery&action=order&var=” + $.tableDnD.serialize())
[/CODE]

That appears to be working ok.

Anyway what the problem is, is with the backend.

This script below is a script that is obviously being called as if it is an external page (above). the problem is I want to use some class variables and definitions from my main script.

How do I do that.

[code=php]
// First just check it is being called from within the domain
if ($_SERVER[‘HTTP_HOST’]==ltrim(DOMAIN,”https://”)) {

// Get the variables
$type = $_GET[‘type’];
$action = $_GET[‘action’];

// now run the the types
switch ($type) {

case “gallery”:

// Now run through the actions
switch ($action) {

case “order”:
break;
}

break;
}
} else {
echo “SECURITY BREACH!”;
}
[/code]

Obviously the definition DOMAIN is a definition defined in one of my include files but the problem is; So is all my msql functions and connection details and all sorts of other stuff.

What I want to know is:
Rather than me listing my include files within this script. Can it somehow use all the definitions and classes that have already been defined through the main webpage?

I hope this is clear, if not just let me know

Thanks
k0r54

to post a comment
PHP

7 Comments(s)

Copy linkTweet thisAlerts:
@JerailFeb 03.2010 — I'm not entirely sure what your question is. Is your script not working? That can't be your entire script...it doesn't actually do anything except check whether the person is using https://...

What I sometimes do for includes on a major project is list all my includes/classes that I plan to use on all or most of the other pages, and include just that file on all the others. Sort of a "global includes" file.
Copy linkTweet thisAlerts:
@k0r54authorFeb 03.2010 — Hi,

Yes that is exactly what I have done.

The script above is what I have so far. The issue is that when AJAX references the file. It calls it as if it is a brand new page. So does not have any of my includes or definitions because it thinks it is a brand new request.

Hope it is a little clearer
Copy linkTweet thisAlerts:
@MindzaiFeb 03.2010 — AJAX just entails sending an HTTP request. The server is (almost entirely*) unaware that the request originated via AJAX. So you need to include the necessary files again if you need functionality defined in them.

*There may be some extra headers set, especially likely if you use a js framework.
Copy linkTweet thisAlerts:
@k0r54authorFeb 04.2010 — Ok,

That was what I thought, it is just a little annoying because all the variables and defs have already been loaded and they will have to be loaded again.

Anyway, from a security point of few. If I am putting this page will all the includes in again. Wouldn't it be easier for someone to access that php page direct and perform functions using the get method?

What would be the best way of securing it down?

Thanks

k0r54
Copy linkTweet thisAlerts:
@MindzaiFeb 04.2010 — Ok,

That was what I thought, it is just a little annoying because all the variables and defs have already been loaded and they will have to be loaded again.[/quote]


That's just it, they haven't already been loaded. You ajax request is a whole new HTTP request.


Anyway, from a security point of few. If I am putting this page will all the includes in again. Wouldn't it be easier for someone to access that php page direct and perform functions using the get method?
[/QUOTE]


That depends entirely on how you've written your script. However, there should be absolutely no way to run arbitrary commands via $_GET, and if there is you need to fix that issue or you could be in real hot water. You seem to be under the impression that AJAX requests are fundamentally different from a 'standard' request - they are not. All of the same security concerns apply, regardless of how the HTTP request originates.
Copy linkTweet thisAlerts:
@k0r54authorFeb 04.2010 — All alot clearer now.

?

Thanks
Copy linkTweet thisAlerts:
@MindzaiFeb 04.2010 — Just looked back at your earlier code and you approach is fine (only running one of a pre-defined set of functions) and should prevent arbitrary functions from being run. Just make sure to take all the normal security steps within your functions themselves, and be careful not to expose any potentially harmful functionality via any of your functions.
×

Success!

Help @k0r54 spread the word by sharing this article on Twitter...

Tweet This
Sign in
Forgot password?
Sign in with TwitchSign in with GithubCreate Account
about: ({
version: 0.1.9 BETA 6.16,
whats_new: community page,
up_next: more Davinci•003 tasks,
coming_soon: events calendar,
social: @webDeveloperHQ
});

legal: ({
terms: of use,
privacy: policy
});
changelog: (
version: 0.1.9,
notes: added community page

version: 0.1.8,
notes: added Davinci•003

version: 0.1.7,
notes: upvote answers to bounties

version: 0.1.6,
notes: article editor refresh
)...
recent_tips: (
tipper: @nearjob,
tipped: article
amount: 1000 SATS,

tipper: @meenaratha,
tipped: article
amount: 1000 SATS,

tipper: @meenaratha,
tipped: article
amount: 1000 SATS,
)...