4

I am building a web service that will communicate with a web page using jquery. I want to build my webservice so it is type safe, without the need to perform conversions on the server side.

How can I issue an ajax call from the client side, using jquery to the server that's expecting an int value parameter.

Edit: I understood that this is not possible. I am programming the server side with c#. currently the web service supports both calls from client side (js) and other utilities (other c# programs). The simplest solution I can currently think of is copying the methods and change their signature to string, then convert the datatypes and call the methods, this time with the correct data types.

Is there any .net 4 attribute that I can decorate my method that performs this automatically?

Thank you

Improve this question

4 Answers 4

Reset to default
7

I'm afraid you can't. All parameters send with an request are of type string.

You could send the parameters as encoded JSON.

Assuming an object

{"int":1}

urlencoded it is

%7B%22int%22%3A1%7D

Send a request to http://domain.org/params=%7B%22int%22%3A1%7D

on domain.org decode it:

$params=json_decode($_GET['params']);

And you will see that the type is still integer:

echo gettype($params->int);

But this somehow also is a serverside conversion(because you need to decode the JSON).

Regarding to the comment beyond, here an example that shows that it's not a pig with lipstick, try it and see if the types are preserved:

<html>
<head>
<title>Test</title>
<script type="text/javascript">
<!--
function request()
{
  var obj={
            "pig":1,
            "cow":2.2,
            "duck":'donald',
            "rabbit":{"ears":2}
          };
  location.replace('?params='+encodeURIComponent(JSON.stringify(obj)));
}

//-->
</script>
</head>
<body>
<input type="button" onclick="request()" value="click">
<pre><?php
  if(isset($_GET['params']) && $params=json_decode($_GET['params']))
  {
    var_dump($params);
  }
?>
</pre>
</body>
</html>

Output:

object(stdClass)#1 (4) {
  ["pig"]=>
  int(1)
  ["cow"]=>
  float(2.2)
  ["duck"]=>
  string(6) "donald"
  ["rabbit"]=>
  object(stdClass)#2 (1) {
    ["ears"]=>
    int(2)
  }
}

That's not bad in my mind, that's simply what JSON has been "invented" for, interchange data between applications.

Improve this answer
Sign up to request clarification or add additional context in comments.

4 Comments

interesting approach, though it adds some overhead for each call (even if it's very simple)
the primary problem there is in my mind the size of the parameter, depending on the amount of values you'll have to send you may very fast scratch the limit for GET-requests.
In some sense, this is lipstick on a pig, no? There is nothing stopping someone from maliciously crafting a json encoded string of the form {"int": "some_string_here"} or {"string": 1}. At the end of the day, you still need to check that the value is of the correct type and a valid value. This might be clever if the server side code properly decodes invalid json strings to some valid value. For example, turning a string that's meant to be an int into 1 or something. As long as you know what happens in that edge case beforehand, this is a neat solution.
The label "int" has nothing to do with the type, if you like to you can use {"pig":1} , pig will also be of type integer. The question is about preserving the types, and that is what my answer provides.
3

You still should convert all values to int on the server, for security reasons.

From client, just pass ints, like script.php?id=2

$.get('script.php?id=2', function(data) {
  $('.result').html(data);
  alert('Load was performed.');
});
Improve this answer

3 Comments

Than you may have security problems. That's the reason why sites got hacked
can you give some extra details on the security issues with this approach?
@vondip that depends on what youre doing with tha data and rages from just submitting "unlogical" values like negative numbers where only positives are allowed to sql-injections if you're not using prepared statements and insert that data to your database without checking
3

you should never trust client data, so you'll have to check all values on serverside anyway - not doing this will cause security holes.

in addition, it's senseless anyway, because you can treat your values as ints, floats or whatever in your JS-code (using parseInt(), parseFloat() ...), but when sending a request to the server, this gets lost - parameters don't have any information about their datatype sent to the server, so they're all treated as strings (and, depending on your server, converted to what is expected when received)

Improve this answer

Comments

1

This will depend on what language you're using on the server side. Some languages will automatically type cast, others won't. For example PHP will convert something like ?id=1 to type int, whereas I believe ruby will keep it a string value unless you explicitly cast it to an int.

Unfortunately, you can't guarantee that something sent from javascript is any sort of type on its own, without being specific about what language is expecting the results on the server. You could send type parameters with each value, but you'd still have to verify that they actually match on the server side.

Improve this answer

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.