How to implement an AJAX op while creating a search bar?

Question

I was trying to make a search bar using AJAX which searches for a user in the database. The AJAX is working fine; it displays correct message when nothing is typed or no user found. The problem is, even if the user is found it displays no user found. This is the PHP file:

<?php
    header('Content-Type: text/xml');
    echo '<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>';
    require_once("includes/connection.php");
    echo '<response>';
    $user=$_GET['user'];

    if($user==""){
           echo "type the username";
    }
    else{   
           $query="SELECT email_id FROM users WHERE email_id={$user}";
           $user_result = mysql_query($query,$connection);

           if($user_result){
                echo "yeah {$user} exists";
           }
           else{
                echo "no such user as {$user} exists";
           }
    }

    echo '</response>';
?>

I'm not including the function creating the xmlHTTP object but this is the rest of the JavaScript code:

function start()
{

if(xmlHttp){
try{
    if(xmlHttp.readyState==0 || xmlHttp.readyState==4)
    {
        user= encodeURIComponent(document.getElementById("user_input").value);
        xmlHttp.open("GET","search.php?user="+user,true);
        xmlHttp.onreadystatechange = mainFunctionHandler;
        xmlHttp.send(null);
    }else{
        setTimeout('start()',1000);
    }
}catch(e){
    alert(e.toString());
        }
}
}

function mainFunctionHandler()
{
if(xmlHttp.readyState==4){
    if(xmlHttp.status==200){
        xmlResponse = xmlHttp.responseXML;
        xmlDocumentElement = xmlResponse.documentElement;
        message = xmlDocumentElement.firstChild.data;
        document.getElementById("divD").innerHTML=message;
        setTimeout('start()',1000);
    }else{
        alert("something went wrong");
    }
}
}

This is not very useful, where is the ajax function, and have you logged what is returned to see that it returns anything at all ? — adeneo, Jul 27 '14 at 14:32
`$user_result` is a resource which, as long as your query is valid, is loosely equal to true. Since you are getting false, your query is invalid (probably because you forgot to put single quotes around `{$user}`). It does not tell you if a user exists. You will need to fetch a row from the database to do that. — James, Jul 27 '14 at 14:35
You need to show your jquery code if we are to be able to help you. — Philip G, Jul 27 '14 at 14:35
PS he really doesn't need to show his javascript code because the error is clearly in the php. — James, Jul 27 '14 at 14:36
thanx a lot guys for the help. how silly of me not to add quotes around $user. but after a corrected it. it now gives user exists for anything i type. — decoder15, Jul 27 '14 at 14:40
You will always get a `result`, you should check if the result has more than `0` rows. — Rob Schmuecker, Jul 27 '14 at 14:42
You have a SQL injection vulnerability in your PHP. As @James implies, your error `echo "no such user as {$user} exists"` is incorrect - this will be triggered if the query fails, not if it is successful but returns zero rows. — halfer, Jul 27 '14 at 15:13
can u pls explain how is it vulnerable to sql injection? @halfer — decoder15, Jul 28 '14 at 04:34
Consider what happens if you run the AJAX script this way: `/ajax.php?user='; DELETE FROM user;--`. Search for "SQL injection PHP parameterisation" to see how to fix it. — halfer, Jul 28 '14 at 14:39

score 1 · Accepted Answer · edited May 23 '17 at 11:57

First, mysql_* functions is deprecated and you shouldn't use the. Read more here: https://stackoverflow.com/a/12860046/3877639

But, your PHP should be in this case (checking how many rows the $result has. It will return true either if there are 0 hits/rows):

<?php
    header('Content-Type: text/xml');
    echo '<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>';
    require_once("includes/connection.php");
    echo '<response>';
    $user=$_GET['user'];

    if($user==""){
           echo "type the username";
    }
    else{   
           $query="SELECT email_id FROM users WHERE email_id={$user}";
           $user_result = mysql_query($query,$connection);

           if(mysql_num_rows($user_result) > 0){
                echo "yeah {$user} exists";
           }
           else{
                echo "no such user as {$user} exists";
           }
    }

    echo '</response>';
?>

How to implement an AJAX op while creating a search bar?

1 Answers1