Closures Can't Be Serialized, How To Do Callbacks via AJAX to PHP?

Question

Question

How can i implement a PHP callback being passed over AJAX with the PHP callback being called by the page requested by AJAX?

The Setup

Comments are posted via AJAX and the paramaters are passed serialized and encrypted (so they can't be changed in transit or carefully crafted AJAX requests to abuse the comments system). The problem is, i need the new total comments amount to update a field in a different mysql table (which will change in every place the comments are used) than what the comments are in themselves.

Example

Someone leaves a comment on a forum topic, that topic needs to know the total comments (without querying the comments table everytime this needs to be known). The problem is, when the comments are posted via AJAX we don't know what the table is to update, what fields, etc as well as having to execute additional code along with it (such as also logging all the members who have left comments on the specific topic).

Solution

I thought about adding two PHP callbacks using closures when declaring the comments widget. These two callbacks (onSuccess() onFailure()) would then be able to do what ever work is needed such as counting the total comments and updating the total comments count for the specific forum topic. Then serialize, encrypt it, pass it as a parameter over ajax, then PHP to decrypt and unserialize the callbacks and execute them.

Why The Solution Breaks

Because closures can't be serialized! Also, i am NOT using eval before anyone suggests it.

The Question Again

How can i implement a PHP callback being passed over AJAX with the PHP callback being called by the page requested by AJAX?

Update

It would appear that some of you are not reading the whole question and understanding that callbacks are to be done in PHP - NOT javascript (using the AJAX callbacks). AJAX is only used to transport the posted comment - not process it (that's what PHP does and that's where the callback comes in which is the problem).

Answer 1

Create a function that is the callback, then pass the function name via ajax, and call it like this:

$callback = 'callback_function_name'; $callback($params...);

Answer 2

Maybe I don't get what you're trying to do, but could you do something like:

window.myappstuff={}

window.myappstuff.onSuccess=function(){
   //Do some stuff here.
}

window.myappstuff.onFailure=function(){
   //Do some different stuff here.
}

Your php callback could then call window.myappstuff.onSuccess or window.myappstuff.onFailure. You could also use random function names instead.

Answer 3

On the whole, I'd have to recommend a rethink. It's considered bad practice to send anything even remotely code-like via ajax, for security reasons. I could, for example, "intercept" the reply using firebug or something, change whatever to my code.
If you send a function name and arguments, I can change them. Suppose your script validates user input, I could just make it so that an ajax call returns a non-existing function. Your script will fail, and with it all form of input validation is gone.
If you send a full function definition as string, I can go even further.

You might have seen people do something like this:

echo 'function(argument){ console.log(argument);}("something"));';

This is just plain text, no JSON. Then, in JS they'll do something that should be considered a crime against humanity:

//readystatechange callback:
if (this.readyState === 4 && this.status === 200)
{
    return eval(this.responseText);//<=== EVIL - EVIL - EVIL
}

This is insane it's EVIL don't even look at this
What you can do as some sort of quick fix is write a generic onreadystatechange function:

//readystatechange
if (this.readyState === 4 && this.status === 200)
{
    var returnObj = JSON.parse(this.responseText);
    switch(returnObj.actionType)
    {
        case 'DomAction':
            return domSwitch(returnObject.data);//<-- based on data domSwitch will decide what to do
        case 'setVar':
            return varSwitch(returnObjcet.data);
        default:
            return educatedGuess(returnObject);//<-- desperate
    }
}

But again, when you send a request, you generally have a certain expectation as to what kind of data you'll get back, and what you want to do with it, so you could create a readystatechange handler on the fly for each ajax request, to deal with that particular call.

Answer 4

Instead of passing callbacks, create the functions in advance on the server and pass the name of the function to execute, with list of arguments to pass it.

---

Besides, here is the place where you start using angular.js. This way you'll have a client side model of the forum topic with a field of posts_count which you'll update on on the client side and angluar's bindings will update the view wherever you use data from this model.