Using Firebug, FireQuery, jQuery no conflict as $jq, from inside a photo page (<a href="http://www.facebook.com/photo.php?pid=xxx&id=y" rel="nofollow">http://www.facebook.com/photo.php?pid=xxx&id=y</a>) :<p><pre><code> var loc = window.location.href.match(/pid=(\d+)&id=(\d+)/);
var args = {
pid: loc[1], // photo ID
id: loc[2], // request sender id? photo owner id? not sure, haven't tested, but my user ID worked when trying to remove someone from a photo in my album
subject: loc[2], // user ID to remove
name: '', // not checked
action: 'remove',
__a: 1,
fb_dtsg: $jq('input[name="fb_dtsg"]').val(),
post_form_id: $jq('#post_form_id').val(),
post_form_id_source: 'AsyncRequest'
};
$jq.post('/ajax/photo_tagging_ajax.php', args);
</code></pre>
It doesn't update the UI. The fb_dtsg and post_form_id are required and seem to be anti-CSRF tokens. Haven't experimented enough to know if they can be reused multiple times.