CODEWITHSUNDEEP
javascriptphpjquerymysqlajax
Mejaniks
Mejaniks

Reputation: 53

Outputting SQL queries with Javascript, PHP and AJAX

I'm trying to have a form, which when submitted returns the output from a simple SQL query onto the page without needing to be reloaded (AJAX). I can get simple outputs to work but when I use the PHP for the SQL query nothing is returned. Any help would be much appreciated. I also can't find anyway to check what is wrong with my Javascript/Php.

Pretty new to web development so apologies if this is trivial. All previously found solutions haven't worked

My Code;

a1.php

<script src='../js/scriptget.js'></script>
<form>
            <fieldset>
                <legend>Login</legend>
                Username:<br>
                <input type="text" name="myusername" placeholder="Username">
                <br>
                Password:<br>
                <input type="text" name="mypassword" placeholder="Password">
                <br><br>
                <input type="submit" value="Submit" onclick='return getAccount();'>
            </fieldset>
        </form>

scriptget.js

function getAccount(){

var phpOut = $.ajax({
    type: 'GET',
    url: 'submitInjection.php',
    data: 'myusername=billsmith&mypassword=password'
});


drawOutput('hello');
return false;
}



function drawOutput(responseText){
    var container = document.getElementById('output2');
    container.innerHTML = responseText;
}

submitinjection.php

<?php
$host="localhost"; //Host Name
$username="root"; // MySql Username
$password="root"; // Mysql Password
$db_name="Honours2"; //Database Name
$tbl_name="Users"; // Table Name

// Connect to server and select database
$conn = mysql_connect("$host", "$username", "$password") or die("Cannot Connect");
mysql_select_db("$db_name") or die("Cannot select DB");


// User and Password sent from form

$myusername = $_GET['myusername'];
$mypassword = $_GET['mypassword'];

/**
Protect MYSQL INJECTION
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);

*/

$sql = "SELECT * 
        FROM $tbl_name 
        WHERE username = '$myusername'
        AND password = '$mypassword'
        ";

$result=mysql_query($sql);

/*  echo $sql; */

if (!$result){
    die('Invalid Query: ' . mysql_error() . $sql);
}

if ($result){
    echo($sql);
}

/*  var_dump($result); */   

while ($row = mysql_fetch_assoc($result)){
    echo $row['username'];
    echo ": ";
    echo $row['balance'];
}

mysql_free_result($result);

$conn->close(); 

?>

Thanks in advance

Upvotes: 3

Views: 1376

Answers (2)

lexabug
lexabug

Reputation: 316

You have to add a success callback function to your $.ajax() call. That callback function should call your 'drawOutput' function with response it gets as a parameter. Something like this:

success: function (data) {
    drawOutput(data);
}

Upvotes: 0

jeroen
jeroen

Reputation: 91792

You need to process the results of your ajax call in for example a success function. You can also use things like .done() or $.when().then(), check the jQuery manual for that.

A simple example using a success function:

var phpOut = $.ajax({
    type: 'GET',
    url: 'submitInjection.php',
    data: 'myusername=billsmith&mypassword=password',
    success: function(data_returned) {
        alert(data_returned);
        // or
        $('#output2').html(data_returned);
    }
});

Some additional notes:

  • Don't use GET to send sensitive information to the server, use POST instead;
  • Don't store plain-text passwords, salt and hash them;
  • The mysql_* functions are deprecated, you should switch to mysqli_* or PDO where you can use prepared statements to avoid sql injection, making escaping unnecessary.

Upvotes: 3

Related Questions