I have a situation here where I need to access the $_POST data to send a sensitive string to a javascript without using localize script and also not letting the sensitive string be available in the console or source ( html ) of the page.

I researched that AJAX can prevent the sensitive string coming from the PHP to be displayed on the source of the page (html) since this will pose a security issue on our side, but then when I tried this approach the global $_POST is not available on the ajax function on that is hooked on the wp_ajax_{action}.

Is there any other way to do this? Any help will be appreciated, Thanks!

UPDATE Oh and by the way, saving the data in the db is not an option since this will feature on the site will accumulate large number of requests.


You can use set_transient to write temporary data to the database and get_transient to read the value back. This keeps the data on the server and available across requests. It's kind like a nonce. Keep in mind writing to your database can jam things up when you get a significant amount of users.

If you want to pass hashed data from PHP to Javascript you could use Hashids -- assuming your data is numeric positive numbers.


$hashids = new Hashids\Hashids('this is my salt');
$id = $hashids->encode(1, 2, 3);
$numbers = $hashids->decode($id);


var hashids = new Hashids("this is my salt"),
id = hashids.encode(1, 2, 3),
numbers = hashids.decode(id);

If you decode anywhere in the JavaScript then someone could potentially get ahold of the salt so it's best to use it only to transport the data.

If you want some random salt, there is an online generator or use wp_salt(). You can also take a look at the way wp_create_nonce() works by adding the logged in user's ID to the salt.

Alternates - some sites warn against using MD5 while others show hashing with openssl.

  • Yeah that's what I'm thinking, so I got rid of that option ( since this will be having a large number of users and requests ) I should've included that on my question. Is there any other way to do this? what I been thinking is hashing the data – GreyWolfram Nov 2 '16 at 4:10
  • hashids.org/php works well with integers – jgraup Nov 2 '16 at 4:15
  • Is that safe to use? since the data I'll be sending would be sensitive ( this cannot be exploited ) so I avoid embedding or making it visible when you view page source the site or even on the dev console. or it is a really really difficult hash that can't be exploited by other human / bot alike. – GreyWolfram Nov 2 '16 at 4:18
  • Maybe if you describe exactly what you're trying to accomplish you could get a better answer. If you want to keep data private then keep in on the server. If it's coming from a $_POST then wouldn't the data come from a user... in which case you could use cookies. – jgraup Nov 2 '16 at 4:28
  • uhhmm I think I'll just go with the hash you mentioned. I just hope no one would exploit it hahaa. thank you @jgraup! – GreyWolfram Nov 2 '16 at 4:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.