On 5/7/07, <b class="gmail_sendername">David Metzler</b> &lt;<a href="mailto:metzlerd@metzlerd.com">metzlerd@metzlerd.com</a>&gt; wrote:<div><span class="gmail_quote"></span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
True enough, but that being said, there&#39;s not a fundamental<br>difference between having an ajax script call a php page that checks<br>to see if a username has been taken, and having a a web form perform<br>the same validation.&nbsp;&nbsp;So don&#39;t assume that Ajax is the problem here,
<br>just realize that it doesn&#39;t provide any additional security either.</blockquote><div><br>The difference is that in AJAX (as most commonly used), if you type &quot;aa&quot;, <br>then all the users with names beginning with Aa will show up for you, then 
<br>you do &quot;Ab&quot;, and get a list, then &quot;Ac&quot;, ...etc.<br><br>This does not happen in a normal not AJAXified form. All you can get<br>is whether the full name you chose exists or not.<br></div></div><br>Ashraf,
<br><br>If this data is sensitive, then just don&#39;t reveal it. Also, check that there<br>is sufficient delay before retrieving results, so as not to get DoS attacks<br>by asking for the data too quickly, overloading the database.
<br>