Ajax to php and store in database

Question

Hello I am having a problem

I am sending a javascript variable to my php script and attemping to store that variable in mysql db but it just does not work.

Here is my code:

js:

<script type="text/javascript">
 var myData = "Hello";
 function AJAXAction () {
 $.ajax({
 url: 'test.php',
 data: { myPhpData: myData },
 success: function (response) {
 alert (response);
 }
 }); 
 }
 AJAXAction();
 </script>

PHP:

 <?php
$link = mysqli_connect("localhost","root","","testt") or die("Error " . mysqli_error($link));
function goDoIt ($link) {
 $why = $_GET['myPhpData']; 
 $sql = "INSERT INTO test_table (id) VALUES '$why'";
 mysqli_query($link, $sql);
 echo "booooom";
}
goDoIt ($link); 
mysqli_close($link);
?>

The result alerts "boooom" but it does not store my $why variable in my table

• lethal-guitar: I smell SQL injection vulnerabilities.. Use prepared statements!
• jeroen: And add error handling.

Answer 1

Try it:

$why = $_GET['myPhpData']; 
$sql = "INSERT INTO test_table (id) VALUES '$why'";
if(mysqli_query($link, $sql)){
 echo "booooom";
}else{
 echo "error";
}

Then you can get if the query is correct or not.

• jeroen: I'd upvote for the error handling, but the obvious sql injection kind of ruins the answer.
• Amauri: Sure, you can add some function that prevents SQL Injection, I just wanted to show a way to cath the error

Answer 2

Variable should be enclosed in {} plus you need to enclose it in ()

 $sql = "INSERT INTO test_table (id) VALUES ('{$why}')";

• Joe: Thank you for this answer, however I have never needed to do this before hand when inserting values into a table? why is this?
• Ankur Aggarwal: @Joe I am not very sure why the other way around it was not working. there are several ways to evaluate the variable. You can concat the string also. stackoverflow.com/questions/16001001/…

Answer 3

$sql = "INSERT INTO test_table (id) VALUES ('".$why."');

you can also do this

• lethal-guitar: Still vulnerable to SQL injection. What if I pass '); DROP TABLE test_table; -- in $why?