保护PHP和AJAX之间的POST请求 - 无用户输入

Question

I have a simple component on a website that is performing a query of all the prod ids from a cluster of products on the page and storing them into an array in jquery. I then send that array to PHP via AJAX as a POST which will ultimately perform a db query on all the ids.

My question is, how can I protect the array coming from the AJAX/JS file into the PHP file in the POST, against user manipulation... meaning I can find the ids in the source code and change them to some random value or even something malicious.

Normally in a user input scenario, you could do a real escape string or similar functionality in the PHP to cover the incoming data. Since I'm sending over an array of numeric values, what would be the best to way to secure that POST request?

Thank you,

-S

Answer 1

Let's assume, that you want to receive array of integer values from a client.

If you write on a raw PHP, then your code can look like this:

if (isset($_POST['ids']) && is_array($_POST['ids'])) {
    $ids = array_map('intval', $_POST['ids']);
    $ids = array_unique($ids); // Optional.
    print(implode(', ', $ids)); // Print values.
}

Sample of user input:

ids[]=1&ids[]=2&ids[]=3&ids[]=malicious_input&ids[]=1

Output:

1, 2, 3, 0

intval takes argument and returns it's integer representation. malicious_input becomes 0 and it's safe for using it in SQL queries.

Some related links:

1. PHP Prepared Statements.
2. I have an array of integers, how do I use each one in a mysql query (in php)?