Outputting SQL queries using Javascript, PHP and AJAX

Question

Outputting SQL queries using Javascript, PHP and AJAX

I am trying to have a form that, when submitted, returns the result of a simple SQL query to the page without the need for a reload (AJAX). I can get simple results to work, but when I use PHP for the SQL query, nothing is returned. Any help is appreciated. I also cannot find anyway to check what is wrong with my Javascript / Php.

Pretty new to web development so apologize if it's trivial. All previously found solutions did not work

My code;

a1.php

<script src='../js/scriptget.js'></script>
<form>
            <fieldset>
                <legend>Login</legend>
                Username:<br>
                <input type="text" name="myusername" placeholder="Username">
                <br>
                Password:<br>
                <input type="text" name="mypassword" placeholder="Password">
                <br><br>
                <input type="submit" value="Submit" onclick='return getAccount();'>
            </fieldset>
        </form>

scriptget.js

function getAccount(){

var phpOut = $.ajax({
    type: 'GET',
    url: 'submitInjection.php',
    data: 'myusername=billsmith&mypassword=password'
});


drawOutput('hello');
return false;
}



function drawOutput(responseText){
    var container = document.getElementById('output2');
    container.innerHTML = responseText;
}

submitinjection.php

<?php
$host="localhost"; //Host Name
$username="root"; // MySql Username
$password="root"; // Mysql Password
$db_name="Honours2"; //Database Name
$tbl_name="Users"; // Table Name

// Connect to server and select database
$conn = mysql_connect("$host", "$username", "$password") or die("Cannot Connect");
mysql_select_db("$db_name") or die("Cannot select DB");


// User and Password sent from form

$myusername = $_GET['myusername'];
$mypassword = $_GET['mypassword'];

/**
Protect MYSQL INJECTION
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);

*/

$sql = "SELECT * 
        FROM $tbl_name 
        WHERE username = '$myusername'
        AND password = '$mypassword'
        ";

$result=mysql_query($sql);

/*  echo $sql; */

if (!$result){
    die('Invalid Query: ' . mysql_error() . $sql);
}

if ($result){
    echo($sql);
}

/*  var_dump($result); */   

while ($row = mysql_fetch_assoc($result)){
    echo $row['username'];
    echo ": ";
    echo $row['balance'];
}

mysql_free_result($result);

$conn->close(); 

?>

Thank you in advance

+3

javascript jquery ajax php mysql

Mejaniks 01 jan. 15 at 18:43

source to share

2 answers

You must add a callback function success

to your call $.ajax()

. This callback function should call the "drawOutput" function with the response it receives as a parameter. Something like that:

success: function (data) {
    drawOutput(data);
}

0

lexabug 01 jan. 15 at 19:12

source to share

jeroen · Accepted Answer · 2015-01-01T19:01:20+0000

You need to process the results of your ajax call, for example in a function success

. You can also use things like .done()

or $.when().then()

, for that check out the jQuery tutorial.

Simple example using a function success

:

var phpOut = $.ajax({
    type: 'GET',
    url: 'submitInjection.php',
    data: 'myusername=billsmith&mypassword=password',
    success: function(data_returned) {
        alert(data_returned);
        // or
        $('#output2').html(data_returned);
    }
});

Some additional notes:

Do not use GET

to send sensitive information to the server, instead use POST

;
Do not store text passwords, salts and their hashes;
The functions mysql_*

are deprecated, you should switch to mysqli_*

or PDO, where you can use prepared statements to avoid sql injection, thus eliminating the need.

Outputting SQL queries using Javascript, PHP and AJAX

More articles: