隐藏ajax上的var数据

Question

I am making AJAX like function but I have problem that bad user can change the value into any other current user. So, how can I prevent this thing?

$live = 'user1';
$fol = 'user2';

function ajax(like){
    var data = 'like='+like+'&CURRENTUSER=<?php echo $live; ?>&TOFOLLOW=<?php echo $fol; ?>';
    $.ajax( {
        type: 'POST',
        url: 'ajax.php',
        data: data,
        success: function(e) {
            $('#success').html(e);
        }
    });
}

Also I want to move this ajax function into ajax.js file, but i am have problem in getting the value $live and $fol of users because echo $live doesn't work on .js. So, is there any way to do this like Facebook, Twitter AJAX function does ?

Answer 1

This solution works for apache web-server. For interpreting JS file using php, add this line to your .htaccess file:

 AddType application/x-httpd-php .js

And put your script inside ajax.js. One other way is using rewrite URL:

 RewriteEngine On
 RewriteRule  ^ajax.js$    ajax.js.php  [L]

And put your scripts inside ajax.js.php file. Of course, all these are if you want to show your URL as JS file.

at the top of your ajax.js or ajax.js.php file, before any kind of output, put this:

header('Content-Type: application/javascript');