JSON以纯文本形式传回，这安全吗？

Question

在过去，当我用jQuery编写HTML时，为了访问特定的PHP页面，我总是这样做：

user.php?Action=1&User=Adrian.....

这将返回纯文本JSON，jQuery将其转换为javascript对象。不过，关于这个方法，我有几个问题。

1. 1、JSON以纯文本形式传回，这安全吗？它可以用于HTTPS吗？
2. 2、如何防止直接访问PHP？简单地检查活动会话？
3. 3、整条通路都可行吗？

多谢！

Answer 1

1) It depends on what you're transferring. If you're transferring credit card data via HTTPS, definitely. If you're transferring less sensitive data, maybe not.

2 and 3) Make sure you check your input for SQL injection, just as you would with any $_GET variable. You should really treat it how you would normally treat $_GET data