CodeIgniter AJAX messages submission security issue I have a small social networking site built in CodeIgniter. Any registered user can send messages to others by visiting their profile.

Today I noticed that one user sent bulk messages to 200 users. How he was able to do that?

Suggestions to make the code secure are welcome.

I have a textarea and a send button on the profile page.

jQuery code on profile page (View)

$("#send").click(function(event){ 
    var msg=$("#quick_message").val();
    var uid=$(this).attr('uid');

    if(msg.length &gt; 0) {
        $("#msg_status").html('&lt;span id="loading_content"&gt;&lt;/span&gt;');

        $.post("&lt;?=base_url()?&gt;message/send_message", {"ids":uid,"msg":msg}, function(data){

        $("#msg_status").html('&lt;span class="errorsuc"&gt;Message sent.&lt;/span&gt;');
        $("#quick_message").val('');
        });
    } else {

    $("#msg_status").html('&lt;span class="errormsg"&gt;Write something to send message.&lt;/span&gt;');
    }
});


Here is my controller

  // send message
   function send_message()
 {
    if (!$this-&gt;users-&gt;is_logged_in()) {
    redirect('signin');
    }

    $user_id=$this-&gt;session-&gt;userdata('user_id');
    $ids=trim($this-&gt;input-&gt;post('ids'));
    $msg=trim($this-&gt;input-&gt;post('msg'));
    $msg=htmlspecialchars($msg);
    $msg=$this-&gt;replaceTolink($msg);
    $msg=$this-&gt;replaceTowinks($msg);

    $pieces=explode(",", $ids);
    foreach ($pieces as &amp;$user_id2) {
    $this-&gt;db-&gt;insert('messages', array('user_id1' =&gt; $user_id,'user_id2' =&gt; $user_id2,'message' =&gt; $msg)); 
    }

    return true;
}


What I need to improve in my code and how to protect the code to send bulk messages?
First of all you should use site_url() in your jquery code instead of base_url() as it provides url flexibility. For more info visit http://codeigniter.com/user_guide/helpers/url_helper.html

And in your controller code i suggest you to use bulk insert instead of loop insert. So you may use this piece of code:

foreach( $pieces as $user_id2)
{
    $insert_arr[] = array('user_id1'=&gt; $user_id, 'user_id2'=&gt; $user_id2, 'message'=&gt;$msg);
}

$this-&gt;db-&gt;insert_batch('messages', $insert_arr);