insert data to database using Jquery/ajax&php

Question

I have been trying to submit data to database using ajax, but I I keep getting stuck.

I took simple code to test it, but it didn't work no matter what I do.

HTML/ajax code

    <?php include("osb.php");?>
<script type = "text/javascript" src = "http://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js"></script>

<!--we have our html form here where user information will be entered-->
        <form action='osb.php' method='post' border='0' id="form1">
            <div id = "container">  <br>
                <label>Name:            </label>    <input type='text' id="name" name='name' /><br>  <br>
                <label>E-mail:          </label>    <input type='text' id="email" name='email' /><br><br><br>

                <input type='hidden' name='action' value='create' />
                <input type='button' value='Submit' id="submit" />
                <input type="reset" value="Reset" class="reset-org">
                <div>

        </form>

<script type = "text/javascript">
    $(function(){

        $('#submit').click(function(){


            $('#container').append('<img src = "img/ajax/ajax-loader.gif" alt="Currently loading" id = "loading" />');
            $.ajax({

                url: 'osb.php',
                type: 'POST',
                data: $('#form1').serialize(),
                success: function(result){
                    $('#response').remove();
                    $('#container').append('<p id = "response">' + result + '</p>');
                    $('#loading').fadeOut(500);

                }

            });

        });
    });
</script>

PHP CODE

   <?php
//set connection variables




$host = "localhost";
$username = "";
$password = "";
$db_name = ""; 

//connect to mysql server
$mysqli = new mysqli($host, $username, $password, $db_name);



//check if any connection error was encountered
if(mysqli_connect_errno()) {
    echo "Error: Could not connect to database.";
    exit;
}

$action = isset($_POST['action']) ? $_POST['action'] : "";



if($action=='create'){ //the the user submitted the form

    $data=$_POST['serialize'];
    $name=$data['name'];  //access data like this
    $email=$data['email'];  //access data like this
//include database connection

//our insert query query
//$mysqli->real_escape_string() function helps us prevent attacks such as SQL injection
    $query = "insert into 'user' VALUES ($name,$email)";
    mysqli_query($mysqli, $query);

//execute the query
    if( $mysqli ->query($query) ) {
        //if saving success
        echo "User was created.";
    }else{
        //if unable to create new record
        echo "Database Error: Unable to create record.";
    }
//close database connection
    $mysqli->close();
}



?>

I get these errors each time I submit the form:

Undefined index: serialize in C:\xampp\htdocs\php1\osb.php on line 29

Database Error: Unable to create record.

Hint: Nowhere in your `form` do you have a form element named `serialize`. — David, Apr 28 '16 at 17:29
How come you have the `//$mysqli->real_escape_string() function helps us prevent attacks such as SQL injection` comment, yet you don't actually use it to prevent injection in your variables `$query = "insert into 'user' VALUES ($name,$email)";`? Either way, when dealing with user input you should bind parameters. — Rasclatt, Apr 28 '16 at 17:29
Thank you very much, as you said there's no serialize element so I did the following ( $name=$_POST['name']; $email=$_POST['email']; ) and this solved the problem. also I removed the include. Thank you for the tips. Have a good day. — Ahmadz Issa, Apr 28 '16 at 17:45
@AhmadzIssa: Note also that your code is *wide open* to **SQL injection**. You should look into using prepared statements with query parameters instead of directly executing user input *as code*. — David, Apr 28 '16 at 17:46

score 2 · Accepted Answer · answered Apr 28 '16 at 18:40

2

remove

$data=$_POST['serialize'];
$name=$data['name'];  //access data like this
$email=$data['email'];  //access data like this

Add

$name=$_POST['name']; 
$email=$_POST['email'];

Regards

answered Apr 28 '16 at 18:40

kontramundo

453
4
9

insert data to database using Jquery/ajax&php

1 Answers1