Re: php and Ajax problem

From:	Arpad Ray	Date:	Tue, 29 May 2007 20:45:41 +0000
Subject:	Re: php and Ajax problem
References:	1	Groups:	php.general
Request:	Send a blank email to php-general+get-255770@lists.php.net to get a copy of this message

Richard Kurth wrote:

        if(response.indexOf('|' != -1)) {

Spot the misplaced bracket.

if($_GET['takeaction']=="delete"){ $uid=$_GET['uid']; echo $uid;

This is wide open to XSS attacks, you need to be just as careful with scripts intended to be accessed via javascript as you do with user facing scripts. If uid is as it sounds, an integer, then intval($_GET['uid']) will do nicely; otherwise at least use htmlentities() to prevent XSS. Arpad