php - 三个简单的 Ajax/php 安全问题

Question

希望有技术知识的人可以为我回答这些问题：

1. 我以前尝试过，我被认为不能在 jQuery Ajax 调用中使用 php 类。这是真的吗，还是有办法让它发挥作用？

2. 如果以上是不可能的，有没有办法在没有类的情况下使用受保护/私有函数和变量？同样，我相信这是不可能的，但很想被证明是错误的。

3. 当数据通过https传递并且无论如何都被加盐和散列服务器端时，以上所有内容是否必要？

Answer 1

1. 这是可能的。你可以使用它们。这取决于你想如何使用它们。有文章如何使用 Zend http://blog.mysql.lt/ajax-aplikacijos-su-zend_json_server.html做到这一点，但它是立陶宛语的。

进一步的dystroy答案......

--

您可以为此使用 PHP 反射类。在 javascript 中实现 php 方法的使用非常容易。

Answer 2

1 . I've tried before, and I'm led to believe that php classes cannot be used in a jQuery Ajax call. Is this true, Or is there a way of making it work?

False. Many many people use PHP pages to answer ajax requests. in fact any server-side technologies able to answer an HTTP request can be used to provide AJAX content, usually in JSON or XML. Her's the first hit Google gave me : Handling JSON like a boss in PHP

2 . If the above is not possible, is there any way of using protected/private functions and variables without classes? Again, I believe this isn't possible, but would love to be proved wrong.

Not relevant as the above is possible.

3 . Is the above all even necessary, when the data is passed over https and is salted and hashed server side anyway?

I'm not sure of your exact meaning but AJAX over HTTPS provides authentication and secrecy. Provided your solution is correctly configured, which is very very rare...

You should understand that

• the essence of AJAX is answering (usually in JSON) javascript made requests made over HTTP just like your usual html page, and PHP can very well do that.
• PHP objects may be serialized as JSOn for the browser but the PHP code doesn't leave the server. Your private or public functions are all safe : nobody will see the implementation. But I hope your business or security doesn't really rely on this code not leaking. Regarding the client side javascript code needed to handle the logic of the objects, it can't be protected : if a browser can read it, a human can do it too.