I am aware of nonces to check for intentions but can't make any sense if I can use them to restrict for database reads somehow? I mean, I am fetching records from the database using AJAX but I don't want anyone to have that data by some other means (POST requests to that
For example, in my AJAX handler I have this much of work (I am sending
$myid along with the action in the AJAX call):
$myid = 5575; $query = "SELECT `id` FROM table WHERE `user_id` = $myid;"; $data = $wpdb->get_col( $query ); echo json_encode($data); die();
I am calling this much of data through AJAX, how can I protect it from evil users who can try to make direct POST calls to that page?
Edit: @Bainternet Thanks for the detailed explanation, appreciate that but my question is really about what @Milo said and I can see that unless I can create a unique nonce for that request, I can't do anything as per @goldenapples. Right?
I am handling all this stuff with Facebook JS SDK, so everything that has to be done is with AJAX only (without page load), and whatever I can think of making the user sign in
wp_signon() or anything, anyone else can do that too without authority. So, I don't have any uniqueness in a user who is actually using the site and the one who is trying to get read some data out other than the site makes the call to fetch the data. And whatever I can do to make it login or anything, that can be replicated by someone else too. Can anyone think of something?
Update: I think I have found a workaround by just calling it with
action and get other parameters from Facebook using PHP SDK. But I am still open for suggestions or anything else for that matter.