ExpressionEngine® Answers is a question and answer site for administrators, end users, developers and designers for ExpressionEngine® CMS. It only takes a minute to sign up.
Sign up to join this community
I have an action URL, index.php?ACT=23, that calls a function which inserts some info into the database.
This is being called from an AJAX function, so I can't control where it is called from.
My concern is that it would be easy to set up a script to call this URL repeatedly and thus insert loads of data and probably bring the site down.
Should I be concerned, what can I do to prevent this?
What data does the script which is being triggered with action URL accept? If that's EE form submission, then you should not worry if you follow standard EE forms security settings/practice.
If it's a custom script that accepts ANY data, then you of course might need to add additional protection to it.
There's a separate chapter in EE docs on security guidelines. Make sure your add-on follows those, specifically look into "Cross Site Request Forgery" section.
The short answer is: it's impossible to answer your question without seeing the code.
