title: Javascript, PHP, and SQL Security - Basic validation of information received.
body: <p>I have been developing a social network. I have noticed some security issues where the user can change the variables in javascript/jquery to other user_id's, text content, and other information that has been loaded into the scripts. And this is all done via the inspect tool or other software that can edit the languages. They can even rewrite the functions. </p>
  
  <p>I load data onto the page via php and sql after sending the url_id to a php function.</p>
  
  <p>I have javascript and jquery scripts that in return use this data to perform ajax, post, and get requests and to perform functions. </p>
  
  <p>How can I stop the user from changing these variables before they are sent off to the server? For example when a user makes a post they can change the id to make it someone else's post, or when they click delete an image they can delete someone else's and it gets more complicated. This is a huge concern.</p>
  
  <p>These scripts are included in the php pages or in php scripts that are loaded via ajax. </p>
  
  <p>How can I stop this? Can you give me an easy explanation? I have been searching for months on how to stop this. I still don't understand how to stop the user from doing so. If there is another way could to do this? Can you provide me with true 100% examples? What are the other options I have? </p>
  
  <p>Here are some snippets of my code</p>
  
  <pre><code>    &lt;? if (login_check($mysqli) == true) : ?&gt;
      &lt;script&gt;
          $.post("auto/online.php?q=&lt;? echo $id ?&gt;");
          function o() {
              setTimeout(function() {
                  $.post("auto/online.php?q=&lt;? echo $id ?&gt;");
                  o();
              }, 6e4);
          }
      &lt;/script&gt;
      &lt;? endif; ?&gt;
  
      &lt;?php echo '&lt;div class="post-btn" onclick="ajaxPost(postenter.value,\''.$name.'\',\''.$id.'\');" title="Post"&gt;Post&lt;/div&gt;'; ?&gt;
  
      function ajaxPost(content,name,id) {
  
      var ip = '&lt;?php echo $ip ?&gt;';
      content = content.replace(/&lt;br\s*\/?&gt;/mg,"\n");
      var postArray = [content, id, ip];
      postArray = JSON.stringify(postArray);
      alert(postArray);
  
      if (content.length == 0) {
          alert('Oops it looks like your post is empty.');
      } else {
          var xmlhttp = new XMLHttpRequest();
          xmlhttp.onreadystatechange = function() {
              if (xmlhttp.readyState == 4 &amp;&amp; xmlhttp.status == 200) {
                  document.getElementById("postenter").innerHTML = "";
                  var html = xmlhttp.responseText; 
                  alert(html);
                  $(html).hide().insertAfter("#wrapper").fadeIn(500);
                  document.getElementById("postenter").value = "";
              }
          }
          xmlhttp.open("POST", "auto/post.php", true);
          xmlhttp.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
          xmlhttp.send('data=' + postArray);
      }
      }
  
      &lt;? if ($id == $user) : ?&gt;
          &lt;div class="modalSetPro" onclick="setProImage(&lt;? echo $picID; ?&gt;,&lt;? echo $uid; ?&gt;)"&gt;Set Profile&lt;/div&gt;
          &lt;div class="modalSetBac" onclick="setProCover(&lt;? echo $picID; ?&gt;,&lt;? echo $uid; ?&gt;)"&gt;Set Background&lt;/div&gt;
          &lt;div class="modalDelImg" onclick="delItemPre(&lt;? echo $picID; ?&gt;, 1, &lt;? echo $uid; ?&gt;)"&gt;Delete&lt;/div&gt;
      &lt;? endif; ?&gt;
  
      function delItemPre(itemID, type, user) {
          var modArr = [itemID, type, user];
          modArr = JSON.stringify(modArr);        
          $("#LoadMe").load('modals/del_modal.php?p=' + modArr);
      }
  </code></pre>