I have created a search_interface node which asks for filters and
onClick event of the
submit button, I have called an external
search.js script. My search_interface node is of a custom content type
Query(this content type has no extra fields other than the default fields created by a new content type)
This script uses
getElementById() to get user input and send it to an external php script using
POST method. This script uses
mysqli_connect() to connect to my database and then does query on the required table(only 1 table is being queried everytime). The result of
mysqli_query() is passed back to the search.js script using
json_encode() and in the
search.js script, I have parsed this jsonData and created a
table string. Then I have used
my_table.innerHTML = "table string" to finally display the query on the drupal node.
Is this method secure?
Can some anonymous user access my .php script and get to know my mysql admin password? ( I use admin password during
Can my whole database be exposed easily even though I always query a single table of the database?
Can the .php file be edited to update or delete parts of my database or the table in which I query every time?
Please help as I am new to drupal 6 and don't know much about security of php files and drupal nodes.