Send post variable in AJAX to PHP file for varaible

Question

What should happen:

When button clicked, it calls report.php and sends "main" as type
Type "main" is picked up in report.php and used as $typename
$data varaible is populated with the contents of main.json

What does happen:

>     [25-Sep-2018 13:56:56] WARNING: [pool www] child 11 said into stderr: "NOTICE: PHP message: PHP Notice:  Undefined index: type in
> /var/www/html/report.php on line 27"
>     [25-Sep-2018 13:56:56] WARNING: [pool www] child 11 said into stderr: "NOTICE: PHP message: PHP Warning:  file_get_contents(.json):
> failed to open stream: No such file or directory in
> /var/www/html/report.php on line 28"
>     2018/09/25 13:57:00 [error] 8#8: *5 FastCGI sent in stderr: "PHP message: PHP Notice:  Undefined index: type in
> /var/www/html/report.php on line 27

index.php

<script>
$(document).ready(function(){
    $("button").click(function(){
        $.ajax({
            url: 'report.php',
            type: "POST",
            dataType:'json',
            data: ({type: main}),
            success: function(result){
                $("#output").html(result);
            }
        }); 
    });
});
</script>

report.php

$typename = $_POST['type'];
echo $typename;
$data = file_get_contents("$typename.json");

main.json

{
    "reportDescription":{ <....>
}

Where is the javascript variable `main` defined? Because I don't see it anywhere, meaning you haven't showed us all the code, or I found your problem. — GrumpyCrouton, Sep 25 '18 at 14:04
Possible duplicate of ["Notice: Undefined variable", "Notice: Undefined index", and "Notice: Undefined offset" using PHP](https://stackoverflow.com/questions/4261133/notice-undefined-variable-notice-undefined-index-and-notice-undefined) — GrumpyCrouton, Sep 25 '18 at 14:05
Second @GrumpyCrouton, also don't see you feeding the resulting JSON back to the client anywhere in your PHP code. — Jared Smith, Sep 25 '18 at 14:05
@GrumpyCrouton I just want it to have the value main (not a variable etc). I'm a bit new, are you saying it should be ```data: ({type: 'main'}),``` — Jimmy, Sep 25 '18 at 14:06
@Jimmy So it should be the string `"main"`? So yes, it should be `data: ({type: 'main'}),` or `data: ({type: "main"}),` — GrumpyCrouton, Sep 25 '18 at 14:08

GrumpyCrouton · Accepted Answer · 2018-09-25T14:14:11.250

4

The problem is that you are trying to send an undefined variable main to your php file. This variable doesn't exist, so you get an error. Strings must be wrapped with single or double quotes.

You should change data: ({type: main}), to

data: {type: 'main'},

(The perenthesis are not needed)

To send the string to your PHP file.

Now in your PHP file, you need to output $data.

$typename = $_POST['type'];
echo $typename;
$data = file_get_contents("$typename.json");
echo $data;

edited Sep 25 '18 at 14:14

answered Sep 25 '18 at 14:09

GrumpyCrouton

8,486
7
32
71

I see, thank you for the help. Will mark as answer in 5 – Jimmy Sep 25 '18 at 14:12
@Jimmy Glad I could help. – GrumpyCrouton Sep 25 '18 at 14:12
Note that the parens are unnecessary. – Jared Smith Sep 25 '18 at 14:13
@JaredSmith Thanks. – GrumpyCrouton Sep 25 '18 at 14:14
@GrumpyCrouton Sorry to be a pain but I tested it and even then I get the same error with this output ```[25-Sep-2018 14:16:04] WARNING: [pool www] child 11 said into stderr: "NOTICE: PHP message: PHP Notice: Undefined index: type in /var/www/html/report.php on line 28"``` – Jimmy Sep 25 '18 at 14:18
@Jimmy On the PHP before anything else, can you do `print_r($_POST)` and tell me what the output is? – GrumpyCrouton Sep 25 '18 at 14:19
`$data = file_get_contents("{$typename}.json");` to get the value rather than the variable id as a string – akaBase Sep 25 '18 at 15:30
@Parody It's between double quotes, so the current code is fine. – GrumpyCrouton Sep 25 '18 at 17:19

David Lemon · Answer 2 · 2018-09-26T08:11:22.593

You should change data: {type: 'main'}, as answered before.

But the php code in that answer could be improved. This code could lead to security issues, particularly to a Server Side Request Forgery. You need to set a clear boundary between the user supplied data and your application code, you need to validate the code to avoid some evil uses of file_get_contents:

One can request a random website by http or use another protocol like ssh to connect to other server reachable from your web server
Someone can scan your directories and read operating system files

So, beware what you do with user input, you need to validate it. I would use the following code.

  // strip all slashes and directories, use only the filename
  $typename = basename($_POST['type']);
  $filename = __DIR__.'/'.basename($_POST['type']).".json";

  if (!file_exist($filename)){
     echo "ERROR";
  }
  // do not output anything till validated
  // echo $typename;
  // use a header to tell the user that this is a json file
  header('Content-Type: application/json');
  $data = file_get_contents($filename);
  echo $data;

Send post variable in AJAX to PHP file for varaible

2 Answers2