Protect database content from being 'sniffed' out (Ajax)

Question

I am using an AJAX request to retrieve and display data from my database.

$("#flexitopicresults").flexigrid(
{
    url: 'venuequery-json.php',
    dataType: 'json',
    colModel : [ (..)
    (..)
}

venuequery-json.php obviously delivers a nice json-formatted version of the data contained in my database to the grid component. The problem is: how can I prevent others from calling the .php file directly and then get a ready-to-use dump of the content of my database (PHP, MySQL) ?

short answer would be not to put that piece of beautifully formatted json in a public domain — Andreas Wong, Mar 21 '12 at 06:15
you can not unless you keep track of request made with hidden token , secret, session , cookie etc. — Khurram Ijaz, Mar 21 '12 at 06:16

score 1 · Accepted Answer · answered Mar 21 '12 at 07:17

1

Use the same method you are currently using to secure the page that fetches the data to secure the ajax one (authentication via cookies or session or htaccess or whatever). You obviously trust that method enough to send it in first place.

answered Mar 21 '12 at 07:17

Collin Green

2,146
14
12

score 0 · Answer 2 · answered Mar 21 '12 at 07:22

You can initialize a session variable in ajax requesting page and then check it in 'venuequery-json.php'. After the checking process, you can renew the session variable. So users must request the ajax requesting page first. Furthermore, you can limit request per time for 'venuequery-json.php' by using sessions again.

Protect database content from being 'sniffed' out (Ajax)

2 Answers2