title: How can I better protect my php, jquery, ajax requests from malicious users
body: <p>I send a lot of data through jquerys getJSON method, an example of a function is</p>
  
  <pre><code>function doSomething(sid){
      if(sid){
  
      $.getJSON("ajax/ajaxDoSomething.php",{sid:""+sid+""}, function(data){
          //alert(data);
          if(data.success == true){
              $('#add_vote_div').html('vote received');
              $('#list_data_div').html(data.html);
          }
          else{
              $('#add_vote_div').html(data.message);
          }
      });
    } 
  }`
  </code></pre>
  
  <p>The problem is that anyone can look at the source and see that the location of the php file its sending the GET data to, therefore you could just point your browser there and append data to the URL. I do checks on the data to make sure its the right data type, but i dont want users to be able to go to the url at all.</p>
  
  <p>I thought maybe put all the ajax files behind the main document root which would work but jquery can't link to absolute paths like</p>
  
  <pre><code>$.getJSON("var/www/ajax/doSomething.php",{sid:""+sid+""}
  </code></pre>
  
  <p>(main document root is var/www/html/)</p>
  
  <p>if they made a $.postJSON that would work better, but it doesn't exist, any ideas?</p>