Is it possible to use inject $.post() from address bar?

Question

I have a javascript in which I use $.post() command to post variables to a php file, I have the URL of the php file hardcoded in the same .js file.

I just want to know if it's possible for someone to inject $.post() command from address bar and send invalid data to the PHP file?

if yes, how to prevent or how to detect those invalid data?

Answer 1

Yes, anybody who knows how to code in JavaScript could send an AJAX POST request to your PHP file.

As for how to detect the invalid data, that depends entirely on what makes the data invalid. You'll simply need to check the POST values against whatever criteria you're expecting valid data to meet, and then ignore any requests that don't meet those criteria.

Answer 2

Yes, it's very simple. Attacker can modify, add or remove any JavaScript running in the browser, modify DOM, etc. Tools like Firebug allow anyone to call arbitrary JavaScript from the console. Moreover one can simply use curl to run your server and send arbitrary data.

if yes, how to prevent or how to detect those invalid data?

You must ensure data validity and integrity on the server side. Also you might want to add some security on the server side and do not depend on some JavaScript function being "hidden".

Answer 3

Sure, by prepending the script with the javascript: scheme you can do pretty much anything you want to a site:

javascript:$.post(/* stuff here */)

You should always validate your incoming data on the server side, because not only may someone use the javascript on your site to do this, but they may use other tools, like curl or whatever else that will let you make http requests.