Ajax : data to SQL

Question

I'm a newbie in AJAX.

I looked for the solution in Google, but I didn't find a working solution.

So, I want to send data from a jquery's draggable div to sql via php.

index.html :

<html>
[...]
<body>
<myDiv>bla bla</div>

<script>
$( "myDiv" ).draggable({ stop: function() {
var position = $(this).position();
var xPos = $(this).css('left');

$.ajax({
      type: "post",
      url: "update.php",
      data: xPos,
      cache: false,
      }
}
});

</script>

</body>
</html>

update.php :

   <?php 
    require("db.php");

             $xpos = $_POST['xPos'];
             mysql_query("UPDATE item SET pos_x = '" . $xpos . "' WHERE ID = '". $post_ID."'");

        mysql_query($query) or die('Error, insert query failed');
    }
    ?>

db.php :

  <?php
    $dbhost              = "**";
    $dbuser              = "**";
    $dbpass              = "**";
    $dbname              = "**";

    $conn = mysql_connect($dbhost, $dbuser, $dbpass) or die ("Error connecting to mysql");
    mysql_select_db($dbname);
    ?>

Could someone tell me where I'm wrong?

The pronoun "I" is always capitalised in English. What is the problem? Why do you think something is "wrong"? What happens when you run your code? — Lightness Races in Orbit
– Lightness Races in Orbit, Commented May 9, 2011 at 10:57
Your update.php contains a syntax error; why is } there? You also have no SQL injection prevention whatsoever; why not? — Lightness Races in Orbit
– Lightness Races in Orbit, Commented May 9, 2011 at 10:58
i smell sql injection. i hope you have magic_quotes_gpc on [to make this clear: i don't encourage anyone to use magic_quotes_gpc instead of proper programming] — lawl0r
– lawl0r, Commented May 9, 2011 at 10:59
@lawl0r: It's 2011. I hope that nobody has magic_quotes_gps on. — Lightness Races in Orbit
– Lightness Races in Orbit, Commented May 9, 2011 at 10:59
You're also missing ); after the braces on the cache: false line in your js. And where is $post_ID defined in your php? — DarthJDG
– DarthJDG, Commented May 9, 2011 at 11:02

Gary Green · Accepted Answer · 2011-05-09 11:08:05Z

1

You need to supply a named attribute for $_POST['xPos'] to work. Change this in your ajax call:

$.ajax({
      type: "post",
      url: "update.php",
      data: xPos, // Change this to --> data: 'xPos=' + xPos,
      cache: false,
      }
} // <-- get rid of this
});

Few errors in your update.php:

         // if xPos is not defined it could throw an error.
         // make sure you do if (isset($_POST['xPos'])) { [...below code here...] }
         $xpos = $_POST['xPos']; 

         // !! sql injection warning!!
         // change to mysql_real_escape_string($xpos),
         //           mysql_real_escape_string($post_ID) ..... etc.
         // also where is $post_ID defined? If this is a magic variable, naughty!
         // always use the global magic variables $_POST $_GET, etc.
         mysql_query("UPDATE item SET pos_x = '" . $xpos . "' WHERE ID = '". $post_ID."'");


    mysql_query($query) or die('Error, insert query failed');
}
?>

edited May 9, 2011 at 11:08

answered May 9, 2011 at 11:00

Gary Green

22.4k6 gold badges52 silver badges76 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Je Change De Nom Over a year ago

Thanks a lot, it works. The "$post_ID" variable is already declared in my complete code.

Collectives™ on Stack Overflow

Ajax : data to SQL

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related