On 5/7/07, <b class="gmail_sendername">David Metzler</b> <<a href="mailto:metzlerd@metzlerd.com">metzlerd@metzlerd.com</a>> wrote:<div><span class="gmail_quote"></span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
True enough, but that being said, there's not a fundamental<br>difference between having an ajax script call a php page that checks<br>to see if a username has been taken, and having a a web form perform<br>the same validation. So don't assume that Ajax is the problem here,
<br>just realize that it doesn't provide any additional security either.</blockquote><div><br>The difference is that in AJAX (as most commonly used), if you type "aa", <br>then all the users with names beginning with Aa will show up for you, then
<br>you do "Ab", and get a list, then "Ac", ...etc.<br><br>This does not happen in a normal not AJAXified form. All you can get<br>is whether the full name you chose exists or not.<br></div></div><br>Ashraf,
<br><br>If this data is sensitive, then just don't reveal it. Also, check that there<br>is sufficient delay before retrieving results, so as not to get DoS attacks<br>by asking for the data too quickly, overloading the database.
<br>