Data gets stored in db inspite of an error

Question

I am accepting Permanent Account Number (pan) from the user and before submitting, I am doing a check if the pan number already exists in db. It is working and I also get an error saying that pan no is already registered If I ignore the error and do not change the pan number and proceed to submit, it goes into the database.

I have observed that after the validation check, the entered number stays there. I wish to know how can I empty the input box after getting the error. If it remains empty, the submit button will not work. So how can I delete the entered number from the input box once the error appears and how can i get the cursor focus in the input box?

Thanks

HTML

<input name="panno" type="text"  id="panno" style="width:219px;" />
<span id="pan_status1"></span>

FUNCTION

$("#panno").change(function()
            {
                $("#pan_status1").html('<img src="images/9.gif" align="absmiddle">&nbsp;Loading Please wait...');
                var id=$(this).val();
                var dataString = 'panno='+ id;
                $.ajax
                ({
                    type: "POST",
                    url: "checkp.php",
                    data: dataString,
                    cache: false,
                    success: function(html)
                    {
                        $("#pan_status1").html(html);

                    } 
                });

            });

CHECKP.PHP

<?php

require("connection/config.php");
    if(isset($_POST['panno']))
    {
    $mpan = $_POST['panno'];

    $sql_check = mysql_query("select * from register where pan_no='".$mpan."'") or die(mysql_error());

    if(mysql_num_rows($sql_check))
    {
    echo '<font color="red"><STRONG>'.$madhar.'</STRONG> is already registered.</font>';


             $response = array();
             $response['successStatus'] = 'error';
             $response['responseMessage'] = $erroMessage;
             header('Content-type: application/json');
             echo json_encode($response);      

    }
    else
    {
             $response = array();
             $response['successStatus'] = 'success';
             $response['responseMessage'] = $erroMessage;
             header('Content-type: application/json');
             echo json_encode($response);
    }
}
?>

EDIT

I made changes in the php file. Now when I enter the pan number and if the entered pan number does not exist in the database, I get the following output next to the input button

{"successStatus":"success","responseMessage":null}

and if it exists, I get the following

123456789012 is already registered.{"successStatus":"error","responseMessage":null}

Now that the status is captured, how can I make the input field empty if the status is error

I do not want to show the html / json output if the status is success and want to show ONLY the html if the status is error.

Answer 1

Since mysql ( php extension ) is deprecated you should mysqli to execute your SQL code. Next would be to escape your incoming POST request, because you don't want to get hacked via an SQL Injection.

You can respond with a JSON in order to announce the client side (jQuery) that you got an error or not.

Moreover, don't send PHP errors to a client, you can use a try / catch solution.

Answer 2

It is straightfoward-enough to clear the field, although the user might not wish for you to do so, especially if they're a slow typist. (They can say to themselves, "d'oh, I swapped two numbers!" and fix their actual tpyo, then push the button again.)

I suggest that what you need to do here is to have your JavaScript remember that the server told it (by means of the POST result) that the number was not valid. (Or, better yet, to remember that it has not yet told you that a particular number is valid.) If the user pushes the button anyway, you can give him an informative message, and not send the server anything.

And then, no matter what, you must also validate the incoming information on the server side. Even though you provide an AJAX-call to validate a PAN number, the server is ultimately responsible for ensuring that the database is updated correctly. It must check again to see that the number is valid, before posting it to the database. And, you must provide appropriate tests of that result, in your JavaScript: to see if the post succeeded, and if not, why not.

Your JavaScript should not knowingly send a missing or invalid PAN number to the host. However, the host must not assume that the client is "doing the right thing." Ultimate responsibility for the content of the database lies with the host.