0

I'm currently making a project for university and i'm trying to implement a google map on to my website

ReportStolenBike.js:

    var mapCenter = new google.maps.LatLng(51.8979988098144,-2.0838599205017);
var geocoder = new google.maps.Geocoder();
var infowindow = new google.maps.InfoWindow();
var myMap;
var marker;


function initialize(){
    var mapOptions = {
        zoom: 15,
        center: mapCenter
    };

    myMap = new google.maps.Map(document.getElementById("mapInput"), mapOptions);

    marker = new google.maps.Marker({
        map: myMap,
        position: mapCenter,
        draggable: true 
    });     

    function markerDragged() {
        var selectedPos = {'latLng': marker.getPosition()};
        geocoder.geocode(selectedPos, showAddressInInfoWindow);
    }        

    google.maps.event.addListener(marker, 'dragend', markerDragged);


    function showAddressInInfoWindow(results) {
        if (results[0]) {
            infowindow.setContent(results[0].formatted_address);
            infowindow.open(myMap, marker);
        }
    }         
}

google.maps.event.addDomListener(window, 'load', initialize);

$('#formReportStolen').on('submit', function(e) {
    var formData = new FormData(this);
    var lat = marker.getPosition().lat();
    var lng = marker.getPosition().lng();

    formData.append("lat", lat);
    formData.append("lng", lng);

    e.preventDefault();
    $.ajax({
        url: "PublicReportStolenDAO",
        method : "POST",
        data: formData,
        contentType: false,
        cache: false,
        processData: false,
        success:function(echoedMsg) {
            if (echoedMsg == "True") {
                alert("Successfully reported.");
            }
        }
    });
});

So in that java script class i'm displaying my google map and trying to take the users current position. My map has a popup that will show that my map is indeed referencing the latitude and longitude but when trying to store them in to my sql database, nothing is storing.

PublicReportStolenDAO.php

  <?php
function StolenReg(){

    $bikeID = $_POST['txtBikeID'];
    $date = $_POST['txtDateofTheft'];
    $lat = $_POST['lat'];
    $lng = $_POST['lng'];

    include "../../include/config.php";

        $verifyFuncBike = "SELECT email FROM `tbl_user` WHERE email = '$email'";
        $resultBike = mysqli_query($connection,$verifyFuncBike);
        $rowBike = mysqli_fetch_array($resultBike,MYSQLI_ASSOC);
        $countBike = mysqli_num_rows($resultBike);

        if($countBike == 1) {

            $sql = "INSERT INTO `tbl_stolen`(BikeID, Date, Lat, Lng)".
            " VALUES ".
            "('$bikeID', '$date', '$lat', '$lng')";

            if(mysqli_query($connection, $sql)) {
            echo "Report successfully sent, please return back to the site.";
                echo $lat;
                echo $lng;
            } else {
                echo mysqli_error($connection);
            }

        }else {

            echo "Error, please return back to the site and try again.";
        }



        mysqli_close($connection);
    } 

stolenReg();

?>

Sorry for the possibly awful code, im very new to web development

Joshua Best
  • 246
  • 1
  • 14
  • 1
    Your code is vulnerable to [SQL injection attacks](https://en.wikipedia.org/wiki/SQL_injection). You should use prepared statements with bound parameters, via either the [mysqli](https://secure.php.net/manual/en/mysqli.prepare.php) or [PDO](https://secure.php.net/manual/en/pdo.prepared-statements.php) driver. [This post](https://stackoverflow.com/q/60174/6634591) has some good examples. – Luca Kiebel May 04 '18 at 18:31
  • Yeah I know, this website wont be released to anyone publicly. Thanks tho – Joshua Best May 04 '18 at 18:35
  • Make sure `$lat` and `$long` are not empty – Luis felipe De jesus Munoz May 04 '18 at 18:40
  • How can I check that? what is the function display text in to the console using java script, considering it isnt echo? – Joshua Best May 04 '18 at 18:50
  • _"this website wont be released to anyone publicly"_ - That's not all Prepared Statements helps you with. Adding unescaped data to the database can break your query if someone, for example, sends in a value that contains a single quote or ends with a backslash. All SQL injections aren't on purpose. – M. Eriksson May 04 '18 at 19:08
  • To log data to the console in js, do: `console.log(myVariable)` – M. Eriksson May 04 '18 at 19:10

1 Answers1

0

i dont think if this the best answer. but in your code use

var lat = marker.getPosition().lat();

that's not function to get your coordinate. to get your coordinate you need to geolocation. so it's should be

var lat = position.coords.latitude
var lat = position.coords.longitude

to ensure your location, you can use this

if (navigator.geolocation) {
navigator.geolocation.getCurrentPosition(function(position) {
    var lat = position.coords.latitude
    var lat = position.coords.longitude
    $.ajax({
        do your ajax
    });      
});
}

sorry for my bad lanaguage. hope this help you.

Tobok Sitanggang
  • 607
  • 5
  • 15