title: How to securely send additional data/parameters via $.ajax for filtering?
body: <p>How to securely send additional data/parameters via $.ajax for filtering?</p>
  
  <p>I'm trying to send additional data/parameters via $.ajax for additional filtering of a returning json. When sending a single term, my setup looks like this: </p>
  
  <p>javascript: </p>
  
  <pre><code>$.ajax({
    url: "/source.php",
    dataType: "json",
    data: {
      term: request.term
    },
  </code></pre>
  
  <p>Console:</p>
  
  <pre><code>GET .../source.php?term=valueA1
  </code></pre>
  
  <p>PHP:</p>
  
  <pre><code>$term = trim(strip_tags($_GET['term'])); 
  $term = preg_replace('/\s+/', ' ', $term);
  
  $a_json = array();
  $a_json_row = array();
  
  $a_json_invalid = array(array("id" =&gt; "#", "value" =&gt; $term, "label" =&gt; "Only letters and digits are permitted..."));
  $json_invalid = json_encode($a_json_invalid);
  
  if(preg_match("/[^\040\pL\pN_-]/u", $term)) {
    print $json_invalid;
    exit;
  }
  
  if ($data = $mysqli-&gt;query("SELECT * FROM accounts WHERE name LIKE '%$term%' OR code LIKE '%$term%'")) {
  while($row = mysqli_fetch_array($data)) {
      ...
  }
  }
  </code></pre>
  
  <p>Now, when adding/sending the additional data/parameters (if available) my setup looks like this: </p>
  
  <pre><code>$.ajax({
    url: "/source.php",
    dataType: "json",
    data: {
      term: request.term,
      tags: $('#input-newsearch-2').val()
    },
  </code></pre>
  
  <p>.val() of $('#input-newsearch-2') can be: </p>
  
  <pre><code>$('#input-newsearch-2').val() = 
  $('#input-newsearch-2').val() = valueA1
  $('#input-newsearch-2').val() = valueA1,valueA2
  $('#input-newsearch-2').val() = valueA1,valueA2,valueA3
  </code></pre>
  
  <p>... and so on. </p>
  
  <p>Console: </p>
  
  <pre><code>GET source.php?term=valueA1&amp;tags=
  GET source.php?term=valueA2&amp;tags=valueA1
  GET source.php?term=valueA3&amp;tags=valueA1%2CvalueA2
  GET source.php?term=valueA4&amp;tags=valueA1%2CvalueA2%2CvalueA3
  </code></pre>
  
  <p>Is it possible to send a comma seperated array like this and how should the php look like to use tags for additional filtering (AND WHERE)? </p>
  
  <p>Edit: This is not a dublicate to the referenced answer since I'm sending a possible array as second parameter. Also it doesn't answer hoe then to fetch it in php und how to use it in the query</p>