how to call a php class function directly using ajax?

Question

Is it possible to call a php class function DIRECTLY using ajax?

Something like below... except ajax...

myclass::myfunction();

I've been using the jquery library to work with AJAX.

$.get('control.php', {func: funcName, arg1: arg1});

The above is similar to what I'm trying to achieve MINUS the control.php;

I'm not sure if this is even possible, but I just thought it would be nice to skip the landing page (control.php) that recieves the funcName. I have a bunch of conditional statements that sort out what class function to run based on the funcName recieved.

It seems kind of silly to do this, to have a separate page just to handle function calls.

Is there a better way?

SLaks · Accepted Answer · 2010-06-08 17:55:43Z

6

No.

If this were possible, it would be a gaping security hole.

answered Jun 8, 2010 at 17:55

SLaks

891k182 gold badges1.9k silver badges2k bronze badges

Sign up to request clarification or add additional context in comments.

8 Comments

payling Over a year ago

Hrm, I don't understand. Can you explain why...? Give example. Thanks

Brendan Long Over a year ago

@payling: Do you really want any javascript page able to call exec() directly? That's an example, but there are plenty of dangerous functions (and some of your functions probably aren't safe to be called like that either).

kamasheto Over a year ago

@payling if there was a way to invoke any method directly that way, one could simply (manually) construct a call that will perform just that. This way, anyone (with or without permission) could perform the logic inside that method (which is probably not a very good idea.)

SLaks Over a year ago

Imagine what would happen if you could write $.ajax({func: 'unlink', path: 'C:\\Windows' }).

kamasheto Over a year ago

@payling I don't think SLaks meant that sort of safety. You can sanitize your data all you want, the kind of exploit we're talking about here exceeds all that. Imagine you have function promote($user_id) { mysql_query("UPDATE Users SET is_admin=true WHERE user_id=$user_id"); } you don't really want just about anyone calling this function now do you ;)

|

kamasheto · Accepted Answer · 2010-06-08 17:59:28Z

0

No. You can't invoke a method directly that way.

You could use routing (like the technique used in CodeIgniter and CakePHP) but that's just syntactic sugar that does the same thing -- control your routes to actions.

answered Jun 8, 2010 at 17:59

kamasheto

1,0307 silver badges12 bronze badges

Comments

2ndkauboy · Accepted Answer · 2010-06-08 18:00:20Z

0

It is not possible because of a simple reason. How should the AJAX knows, where to find the function. It needs to have a URL to locate the function so it doesn't work without a php file in between.

answered Jun 8, 2010 at 18:00

2ndkauboy

9,4033 gold badges34 silver badges67 bronze badges

Comments

Olly Hicks · Accepted Answer · 2010-06-08 19:56:38Z

0

No for security reasons but there is no reason why you can't do something like this

function run($args){
  //do stuff
}

echo run($_REQUEST);
//or
echo run($REQUEST['name']);

answered Jun 8, 2010 at 19:56

Olly Hicks

1,0941 gold badge9 silver badges13 bronze badges

Collectives™ on Stack Overflow

how to call a php class function directly using ajax?

4 Answers 4

8 Comments

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

8 Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related