ajax php安全问题[重复]

Question

Possible Duplicate:
How to authenticate AJAX call?

I have a page ajax_check_user_pass that checks user's username and password through ajax.

Ajax code in this page posts username and password to a php file php_check.php. The php_check.php checks username and password to match in a database.

How can I be sure that username and password that php_check.php recieves is from ajax_check_user_pass and is not faked by someone?

I have used sessions but it's not working. Also, I know that checking referrer is not a reliable.

Thanks in advance.

Answer 1

The fact is, you don't know who is sending you username's and password's, the fact that they have to enter this information is proof that you don't know who they are, as long as you sanitize the posted information, it should work exactly how you want it to.

Many sites implement a maximum number of attempts, but really that's up to you.