PHP get data from AJAX post and filter it

Question

I have a form that I want to communicate with the server throw an AJAX post. The query that I did says that was an error on query but I don't see the problem.I tried different AJAX code but seems that the post works because it passes the if($_POST).

$('#submit').click(function(e) {

    var url = "handler/dForm.php"; // the script where you handle the form input.

    $.ajax({
           type: "POST",
           url: url,
           contentType: 'application/json; charset=utf-8',
           data: $("#idForm").serialize(), // serializes the form's elements.
           success: function(data)
           {
               console.log(data); // show response from the php script.
           },
           error: function(xhr,textStatus,err)
            {
                console.log("readyState: " + xhr.readyState);
                console.log("responseText: "+ xhr.responseText);
                console.log("status: " + xhr.status);
                console.log("text status: " + textStatus);
                console.log("error: " + err);
           }                    
         });

    e.preventDefault(); // avoid to execute the actual submit of the form.
});

The server part

require_once 'connect.php';
$name = isset($_POST['name']) ? $_POST['name'] : '';
$subject = isset($_POST['Subject']) ? $_POST['Subject'] : '';
$message = isset($_POST['Message']) ? $_POST['Message'] : '';
$email = isset($_POST['Email']) ? $_POST['Email'] : '';

if (isset($_POST)) {

 $email = $DBcon->real_escape_string($email);
 $message = $DBcon->real_escape_string($message);
 $subject = $DBcon->real_escape_string($subject);
 $name = $DBcon->real_escape_string($name);

 $query = "INSERT INTO customer(name,messaje,subject,email) VALUES('$name','$message','$subject','$email')";

  if ($DBcon->query($query)) {
   $msg = "<div class='alert alert-success'>
      <span class='glyphicon glyphicon-info-sign'></span> &nbsp; successfully registered !
     </div>";
  }else {
   $msg = "<div class='alert alert-danger'>
      <span class='glyphicon glyphicon-info-sign'></span> &nbsp; error while registering !
     </div>";
  }
 echo  $msg;


 $DBcon->close();
}else{
    echo "err";
}

The HTML Form :

<form id="idForm">
                        <input type="text" class="col-md-6 col-xs-12 name" name='name' placeholder='Nume *'/>
                        <input type="text" class="col-md-6 col-xs-12 Email" name='Email' placeholder='Email *'/>
                        <input type="text" class="col-md-12 col-xs-12 Subject" name='Subject' placeholder='Subiect'/>
                        <textarea type="text" class="col-md-12 col-xs-12 Message" name='Message' placeholder='Mesaj *'></textarea>
                        <div class="cBtn col-xs-12">
                            <ul>
                                <li class="clear"><a href="javascript:void(0)"><i class="fa fa-times"></i>Sterge campurile</a></li>
                                <li class="send"><a href="javascript:void(0)" id="submit"><i class="fa fa-share"></i>Trimite</a>
                                </li>
                            </ul>
                        </div>
                    </form>

What is the exact error you received? It's gonna be hard to help without knowing what that error is. — Wesley Smith, Nov 12 '17 at 18:27
Are you saying that your code executes the `echo "err";` in the else statement at the very bottom? Returning 'err' to the front end — Wesley Smith, Nov 12 '17 at 18:31
What do you get if you change that to `$msg = "Error description: " . mysqli_error($DBcon);` ? — Wesley Smith, Nov 12 '17 at 18:41
@DelightedD0D Thanks, It gave me an error about a column name,I fixed it ,now the query succeeds but the SQL table is still empty.Edit :The table is populated with empty rows.From that I can see the isset($_POST['name']) is empty — King Tsunamy, Nov 12 '17 at 18:48
Can you try removing the `contentType: 'application/json; charset=utf-8',` from your ajax? — Wesley Smith, Nov 12 '17 at 19:14
@DelightedD0D It works but I get the error r: SyntaxError: Unexpected token S in JSON at position 0 .Is real_escape_string enough for checking the input? — King Tsunamy, Nov 12 '17 at 19:26

score 2 · Accepted Answer · answered Nov 12 '17 at 19:44

2

First problem that I see is if (isset($_POST)) It is always TRUE. You have got to check if specific field is set ie. if (isset($_POST['name'])).

Second is that row: $query = "INSERT INTO customer(name,messaje,subject,email) VALUES('$name','$message','$subject','$email')";

I think You misstyped message column. You have messaje.

And as a tip for debugging use echo $DBcon->error; if query() returned FALSE.

answered Nov 12 '17 at 19:44

instead

3,101
2
26
35

Thanks,what about the SyntaxError: Unexpected token S in JSON at position 0 ?Is real_escape_string enough for checking the input? – King Tsunamy Nov 12 '17 at 19:50
1

Remove `contentType: 'application/json; charset=utf-8',` from ajax request. About real_escape_tring check other questions like: https://stackoverflow.com/questions/110575/do-htmlspecialchars-and-mysql-real-escape-string-keep-my-php-code-safe-from-inje or https://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string/12118602#12118602 – instead Nov 12 '17 at 19:59

PHP get data from AJAX post and filter it

1 Answers1