Reputation: 53
I'm trying to have a form, which when submitted returns the output from a simple SQL query onto the page without needing to be reloaded (AJAX). I can get simple outputs to work but when I use the PHP for the SQL query nothing is returned. Any help would be much appreciated. I also can't find anyway to check what is wrong with my Javascript/Php.
Pretty new to web development so apologies if this is trivial. All previously found solutions haven't worked
My Code;
a1.php
<script src='../js/scriptget.js'></script>
<form>
<fieldset>
<legend>Login</legend>
Username:<br>
<input type="text" name="myusername" placeholder="Username">
<br>
Password:<br>
<input type="text" name="mypassword" placeholder="Password">
<br><br>
<input type="submit" value="Submit" onclick='return getAccount();'>
</fieldset>
</form>
scriptget.js
function getAccount(){
var phpOut = $.ajax({
type: 'GET',
url: 'submitInjection.php',
data: 'myusername=billsmith&mypassword=password'
});
drawOutput('hello');
return false;
}
function drawOutput(responseText){
var container = document.getElementById('output2');
container.innerHTML = responseText;
}
submitinjection.php
<?php
$host="localhost"; //Host Name
$username="root"; // MySql Username
$password="root"; // Mysql Password
$db_name="Honours2"; //Database Name
$tbl_name="Users"; // Table Name
// Connect to server and select database
$conn = mysql_connect("$host", "$username", "$password") or die("Cannot Connect");
mysql_select_db("$db_name") or die("Cannot select DB");
// User and Password sent from form
$myusername = $_GET['myusername'];
$mypassword = $_GET['mypassword'];
/**
Protect MYSQL INJECTION
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);
*/
$sql = "SELECT *
FROM $tbl_name
WHERE username = '$myusername'
AND password = '$mypassword'
";
$result=mysql_query($sql);
/* echo $sql; */
if (!$result){
die('Invalid Query: ' . mysql_error() . $sql);
}
if ($result){
echo($sql);
}
/* var_dump($result); */
while ($row = mysql_fetch_assoc($result)){
echo $row['username'];
echo ": ";
echo $row['balance'];
}
mysql_free_result($result);
$conn->close();
?>
Thanks in advance
Upvotes: 3
Views: 1376
Reputation: 316
You have to add a success
callback function to your $.ajax()
call. That callback function should call your 'drawOutput' function with response it gets as a parameter. Something like this:
success: function (data) {
drawOutput(data);
}
Upvotes: 0
Reputation: 91792
You need to process the results of your ajax call in for example a success
function. You can also use things like .done()
or $.when().then()
, check the jQuery manual for that.
A simple example using a success
function:
var phpOut = $.ajax({
type: 'GET',
url: 'submitInjection.php',
data: 'myusername=billsmith&mypassword=password',
success: function(data_returned) {
alert(data_returned);
// or
$('#output2').html(data_returned);
}
});
Some additional notes:
GET
to send sensitive information to the server, use POST
instead;mysql_*
functions are deprecated, you should switch to mysqli_*
or PDO where you can use prepared statements to avoid sql injection, making escaping unnecessary.Upvotes: 3