pass data using value of div (security)

Question

is it safe to send the data(text) of div to the server via ajax? or get the url of an <a> tag and use it?

ex.

 <div id="get-value">Some Value</div>
 <button id="send" data-url="process.php"></button>

javascipt

$('#send').click(function() {
     $.ajax({
        url: this.dataset.url,
        dataType: 'json',
        type: 'post',
        data: {
           value: $('#get-value').text(),
        }
     });
});

What if I edit the text in the div and the data-url of button in the developer tools and click the button after?

Answer 1

It is safe to do this.

When working with Javascript and AJAX, you are subject to this inherent problem: it can always be modified. The best way to minimize the issue is to make sure that no secure operations occur on the client, and instead let the Javascript do the display and submit.

In this case, you can leave it as it is. As long as you are sanitizing the user input on the server side then you are doing most all you can (aside from obfuscation, which is rarely a good idea in Javascript).