Sending data via ajax using php

Question

So, here is ajax setup that I have for my wordpress site.

Page_1.php:

<?php echo '<div class="button" data-post_date="'.$rh_post_date.'" data-post_author_id="' .$rh_author_id. '" data-post_id="' .$id. '">' ;?>

custom_js.js:

jQuery('.button').click(function(e) {
        e.preventDefault();
        var indiv_id = jQuery(this).data("post_id");
        var indiv_post_author = jQuery(this).data("post_author_id");
        var indiv_date = jQuery(this).data("post_date");
        jQuery.ajax({
            type: "GET",
            url: upload_image.ajax_url, 
            dataType: 'html',
            data: ({ action: 'rhmp_indi_form', post_id: indiv_id , post_author_id: post_author, post_date_id: indiv_date}),
            success: function(data){
                    jQuery('#rh_pop').html(data);
        },
        error: function(data)  
        {  
        alert("Error!");
        return false;
        }  
        }); 
 }); 

Page_2.php:

<div id="rh_pop">       
      <?php
         $page_2_post_id = $_REQUEST['post_id'];    
         $page_2_post_author_id = $_REQUEST['post_author_id'];  
         $page_2_post_date_id = $_REQUEST['post_date_id'];
      ?>
</div>

As you can see, when the button in the page_1.php is clicked, the data become variables in custom_js.js. These variables are then sent to the page_2.

Now, I know that this is not secure at all and can be hacked easily.

So, how do I send data such as data-post_date or post_author_id to another page via ajax using php?

Answer 1

First of Ajax is a technique that is used in javascript to send a httprequest to the php server. The server handles that request and sends back its result. Its the same as requesting a page normally but then its without reloading the page.

Creating variables in javascript with php for use with ajax doesn't mean that php is the one doing anything ajax related. Hope this clears up a missunderstand.

More info on this: https://en.wikipedia.org/wiki/Ajax_%28programming%29

Sending data to the server is never safe. You can make help features like you need to fill in this field with a name and go on. Or maybe even use a disable the submit button if there aren't 3 or more numbers in a field but this is all to help the user and to make it unlikely that the server will get requests that will never be valid anyway.

This is the reason why server side validation is always needed and client side validation is more of a user friendly thing and making sure the server doesn't get requests that can be detected from the client side already.