On 5/7/07, David Metzler <metzlerd@metzlerd.com> wrote:
True enough, but that being said, there's not a fundamental difference between having an ajax script call a php page that checks to see if a username has been taken, and having a a web form perform the same validation. So don't assume that Ajax is the problem here, just realize that it doesn't provide any additional security either.
The difference is that in AJAX (as most commonly used), if you type "aa", then all the users with names beginning with Aa will show up for you, then you do "Ab", and get a list, then "Ac", ...etc. This does not happen in a normal not AJAXified form. All you can get is whether the full name you chose exists or not. Ashraf, If this data is sensitive, then just don't reveal it. Also, check that there is sufficient delay before retrieving results, so as not to get DoS attacks by asking for the data too quickly, overloading the database.