Indie-Resource.com

For the sake of keeping my code DRY, and so that I can manage classes easier, I want to have my PBBG set up where a div is specified with a CSS class that matches the action you would take. For example, an arrow you could click might be assigned the class action_go_north, and would pass this class to a jQuery function on click, like @jQuery:action( go_north );.

Then jQuery would pass that action onto an action handler in PHP, which would pass that to it's respective class/function to return data. What I am wondering, is is it safe to accept post data in this way? I will be validating data server side, but I'm just wondering if there are any immediate security risks to doing this.

Honestly, provided you have the data server-side to compare to for verification, you aren't going to print it to the screen, and you make sure it is not a huge amount of data, you can accept almost anything from the client you can send. Everything sent from the client can be spoofed or altered as easily as anything else (well, GET values are easier, but really nothing is harder) since knowledgeable users can send any data they want in requests to your server. So basically, send whatever you want to the web server, and use the same level of scrutiny and skepticism that you would any other time. Which is to mean total scrutiny and skepticism.

Ah okay thanks Jackolantern. My data sanitizing and server-side validation is pretty solid, so I guess I shouldn't worry about it too much.