Reputation: 1754
I am working on a project, where it's possible for users to like each others stuff. Right now my jQuery gets the id from the HTML, to identify what thing to like. But people are able to open an Inspector in the browser, and edit the id, and that way like a whole other thing.
I am searching for alternative ways to do this.
I've thought of making a unique string, but that's kinda the same, since they still would be able to copy/paste the string to another element.
Thanks in advance.
Upvotes: 0
Views: 72
Reputation: 7890
Try this below code:
<?php
if (!isset($_SESSION)) session_start();
//Consider this as your IDs of post which is fetched from database.
$pageIDs = array(1,2,3,4,5,6,7,8,9,10);
foreach($pageIDs as $index => $key)
{
$uniqueID = uniqid();
echo '<a href="#" class="like" rel="'.$index.'#'.$uniqueID.'"></a>';
$_SESSION[$uniqueID] = $index;
}
//Now when someone clicks on like button, pass the rel attribute in as POST variable to PP
if($_POST['id'])
{
$array = explode('#',$_POST['id']);
$actualID = $_SESSION[$array[1]];
if($actualID === $array['0'])
{
//Everything is fine
return true;
}else{
//some one edited your HTML code
}
//you can destroy your session variable here.
}
?>
Upvotes: 1