JavaScript in PHP\MySQL query

Question

Hi I am facing a problem in my PHP query ,

Whenever I use query like written below works But and find one row in BD

$txtx = "nope";
$query = "SELECT * FROM `users` WHERE `uname`='Shabi RoxX' AND `pass`='$txtx'"; 

When I use to write "nope" like this

$txtx = "<script>document.write(String.fromCharCode(110,111,112,101));</script>";
$query = "SELECT * FROM `users` WHERE `uname`='Shabi RoxX' AND `pass`='$txtx'";

this query find 0 rows, however both prints/echo same string? whats wrong?

• luchosrock: As far as I know, you can't just pass a javascript value directly to php, even if you're passing a string. The js code will be processed in the client side, not in the server side.

Answer 1

You cannot write it like this --

Javascript is something that will execute at client side(browser) and PHP is a server side scripting language. And your are trying to execute JS in PHP...you cannot!

$txtx = "<script>document.write(String.fromCharCode(110,111,112,101));</script>";

• Shabi RoxX: What If I use use hex code in string ? It will also only execute for client?
• luchosrock: @ShabiRoxX The point is that the js code will be executed in the browser and the php code will be processed before -in the server side- the whole page gets to the browser, so how could you asign a value obtained after the server processed it? For a solution to this you should try an ajax/jquery way.
• Shabi RoxX: Ok thanks for your answer . and what about this string? $query = "SELECT * FROM users WHERE uname='Shabi RoxX' AND pass='nope'"
• Suresh Kamrushi: i guess this are html special char (Numerical Code).webdesign.about.com/library/bl_htmlcodes.htm

Answer 2

What are you trying to accomplish here? What is the bigger problem you’re trying to solve?

The way it looks now, you want to check a password that's known in Javascript (on the client = the browser), using PHP (on the server).

While you can use PHP (on the server) to write Javascript which will be executed on the client, you can’t do it the other way round. To call server-side code from the client-side, you will have to make a POST or GET request, either by submitting a page, or (preferably) by making an AJAX call from Javascript.

Answer 3

use php's CHR function instead.

$txtx = chr(110).chr(111).chr(112).chr(101);
$query = "SELECT * FROM `users` WHERE `uname`='Shabi RoxX' AND `pass`='$txtx'";

I hope this helps. Thanks