Pass parameter to Ajax safe way

Question

I want to pass the id to the controller (ASP.NET MVC 5) and get the result from the controller. I have the following code:

function LoadBook(id) { $.ajax({ url: '/Book/GetBookById' + id, type: 'get', dataType: 'json', success: function (data) { }, error: function (err) { alert("Error: " + err.responseText); } }) }

Is it safe to do url: '/Book/GetBookById' + id? And if it doesn't safe, is there any way to do this?

If you're looking for a RESTful way to do this, your URL should look like /Book/[id] or /Book/GetBookById/[id] (the second way seems redundant to me). Non-RESTful you could do /Book/GetBookById?id=[id]. That said, the VS tools could scaffold this for you automatically. — richb01
– richb01, Commented Sep 11, 2016 at 1:52

richb01 · Accepted Answer · 2016-09-11 02:04:44Z

1

The prescribed way to do this is:

public JsonResult GetBookById(int id) { // do your getting here var yourdata = MyDataAccessClass.getBookById(id); return new Json(yourdata, JsonRequestBehavior.AllowGet); }

Your AJAX url would then be:

function LoadBook(id) { $.ajax({ url: '/Book/GetBookById/' + id, type: 'get', dataType: 'json', success: function (data) { }, error: function (err) { alert("Error: " + err.responseText); } }) }

This is the "safe" and standard way to make calls in Microsoft's MVC.

answered Sep 11, 2016 at 2:04

richb01

1,1272 gold badges13 silver badges25 bronze badges

Sign up to request clarification or add additional context in comments.

7 Comments

SLaks Over a year ago

You still need to escape the parameter.

richb01 Over a year ago

Only if it's not an integer. In my example it is, so no escaping is needed. Of course, it's not clear what the data type is in the OP's code. :-)

SLaks Over a year ago

@richb01: Just because the parameter is declared as an integer doesn't mean that id in the JS is always an integer. It could have a query string or ../some other action and be used to attack things.

SLaks Over a year ago

@UçanKartal: Learn about URL encoding.

SLaks Over a year ago

@richb01: No. If id is 1?secretParam=blah or ../DeleteBook/24, no error will be thrown.

|

Khiem Tran · Accepted Answer · 2016-09-11 01:57:41Z

1

You need to use

 encodeURIComponent(Id)

answered Sep 11, 2016 at 1:57

Khiem Tran

6,16916 silver badges25 bronze badges

Collectives™ on Stack Overflow

Pass parameter to Ajax safe way

2 Answers 2

7 Comments

Comments

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

7 Comments

Comments

Related