I have a table like...
THINGS_TABLE
============
thing_key int PRIMARY KEY
thing_num varchar(20)
thing_title varchar(20)
thing_description varchar(20)
And some ColdFusion (server-side code) functions that can add, edit and delete from this table. For example a createThing function might look like this in ColdFusion. The cfqueryparam parameters in the cfquery should prevent SQL injection, so I don't think SQL injection is something I need to worry about.
<cffunction name="createThing" access="remote" returntype="void">
<cfargument name="thing_num" type="string" required="yes">
<cfargument name="thing_title" type="string" required="yes">
<cfargument name="thing_description" type="string" required="yes">
<!--- write to db --->
<cfquery name="createThingQuery" datasource="my_datasource">
INSERT INTO THINGS_TABLE (thing_num, thing_title, thing_description) values (
<cfqueryparam cfsqltype="cf_sql_varchar" value='#thing_num#'>,
<cfqueryparam cfsqltype="cf_sql_varchar" value='#thing_title#'>,
<cfqueryparam cfsqltype="cf_sql_varchar" value='#thing_description#'>)
</cfquery>
</cffunction>
Is it safe to reveal the actual column names in ajax calls that run the server-side code? For example, an ajax call that might look like this:
$.ajax({
type: "POST",
url: "thingFunctions.cfc",
data: { method : "createThing",
thing_num : "the number",
thing_title : "the title",
thing_description : "the description"
}})
This ajax makes it really obvious what the actual column names are in the database, and it is certainly possible for my ColdFusion function to use different argument names, but is there actually any advantage to use different names? It seems to me like it might just make the code more confusing for a developer to read, without providing any advantages from a security standpoint.
Also, perhaps there are other issues with using ajax calls like this that I'm not thinking of? I.e. a user maybe could edit the page JavaScript and call my ColdFusion code in ways it wasn't originally intended?
insert
line on the server will change. – Neil Smithline Mar 26 '16 at 14:15INSERT INTO THINGS_TABLE (thing_num, thing_title, thing_description)
line. Specifically the list of column names located there. Everything else could stay exactly the same. In fact this is the exact reason why this question exists--since it is possible to use names that differ from the actual column names in the data object that $.ajax accepts it made me wonder if there is any security advantage to doing so. – Ectropy Mar 28 '16 at 13:44