securely passing sensitive data from PHP to javascript

Question

My scenario looks like this, I'm showing database paginated grid on the screen. I want add a button to download CSV spreadsheet . so I coded something like this:

$(function(){
	
	var  file_complete = false;
	var  final_sql = $('.initiate_download').val();
	var  orderby = $('#search_submit').data('orderby');

	 
	var	 $posturl = $url + "index.php/Spawner/launch_spawner";		
 

	$('#downloadModal').modal('hide');
		
	$('.initiate_download').on("click", function(e) {
		e.preventDefault();
		
		$('#pleaseWait').html($html);
		
		setTimeout(function() {
			$.ajax({							// initiate download
				url:  $posturl,
				type: "POST",
				data: {
					final_sql: final_sql,
					orderby: orderby,
					report: $report 
						},
				success: function(data) {
					var download_id = data;
					// console.log(download_id);
					check_download_status(download_id);
				}
			})
		}, 2000);
	})
});

	<div class="row top-buffer">   
		
		  <button id="search_submit" class="btn btn-primary initiate_download" type="submit" value="<?php echo $sql; ?>"    data-orderby="<?php echo $orderby;?>"  name="final_sql_lic" >Download List</button>
	
	      <span id="pleaseWait">  </span>        
		
		</div>

it works fine, but the problem is that you can view SQL with view page option, is there a way around it ?

If we can see your SQL query in the HTML, you should rethink your design. — D4V1D
– D4V1D, Commented Sep 18, 2015 at 21:53
if you're running sql that's coming from the client, good luck with keeping your server alive... — Marc B
– Marc B, Commented Sep 18, 2015 at 21:54

Jacob Gardner · Accepted Answer · 2015-09-18 22:45:27Z

2

What most people do is they don't embed the SQL on page, but instead expose URLs that handle the SQL stuff behind the scenes.

In your example, you might create a page like this: http://website.com/api/csv?select=col1,col2,col3&orderBy=someColumn&where=someCondition

Then your php will take those parameters and generate the sql based off of those and run the query. Make sure you securely handle the input to avoid SQL injection (See http://bobby-tables.com/php.html).

The problem with your current scenario is that someone viewing your source will plainly see that you're passing SQL directly to your server, meaning they can generate their own SQL like: DROP TABLE table1, table2; or worse.

answered Sep 18, 2015 at 22:45

Jacob Gardner

3153 silver badges9 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

securely passing sensitive data from PHP to javascript

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related