title: jQuery AJAX add/edit/delete actions can be hacked?
body: <p>Just wondering about a security issue. Right now I'm using the following function to delete movies from my database:</p>
  
  <pre><code>    function deleteVideo(video_id){
          function mycallbackform(v,m,f){
              if(v=="yes"){
                  $.ajax({
                      type: "POST",
                      url: "delete.php?action=video",
                      data:   "video_id=" + video_id,
                      success: function(html){
                          if(html == "1"){
                              //$("#result").html(html);
                              $("#row_"+video_id).fadeOut("slow");
                              $("#result").show();
                              $("#result").html("&lt;div class='notification success png_bg'&gt; &lt;div&gt;&lt;?php echo $LANG_video_succesfull_delete; ?&gt; &lt;/div&gt;&lt;/div&gt;");
                              setTimeout(function(){ $('#result').fadeOut('slow'); }, 5000); 
                          }else{
                              $("#result").show();
                              $("#result").html(html);
  
                          }
                      }
                  });
              }
          }
              $.prompt('Are you sure?',{ buttons: { Ok: 'yes', Cancel: 'no'}, callback: mycallbackform});
              }
  </code></pre>
  
  <p>At the back end the following code is executed:</p>
  
  <pre><code>/*** DELETE data ***/
      /*** prepare the SQL statement ***/
      $stmt = $dbh-&gt;prepare("DELETE FROM videos WHERE username=:username AND videos_id=:video_id");
      $stmt-&gt;bindParam(':username', $currUser);
      $stmt-&gt;bindParam(':video_id', $video_id);
  
  
  
      /*** execute the prepared statement ***/
      $stmt-&gt;execute();
  </code></pre>
  
  <p>The username is stored in a session in this case.</p>
  
  <p>Is there any way user A will be able to delete user B data with this code?</p>
  
  <p>I was thinkinig to add a query to check if the current user is the same user who added the video in the database. If not he can't delete the data. But is this necessary or is this code safe enough?</p>
  
  <p>Thanks in advance.</p>