2

I cant not figure out why this script doesnt work. It has to do with something within the AJAX POST script/function. Right now, when I hit submit on my form it runs the php code on the same page. What it should do it is send the values of the form to project_ajax.php, then at page will return a var of success that will be true or false.

$(document).ready(function () {
    $('div#didIt').hide();
    $('form[name=adminForm]').submit(function () {
        $.post('/project_ajax.php', {
            action: $('[name=action]').val(),
            pId: $('[name=pId]').val(),
            name: $('[name=name]').val(),
            url: $('[url=url]').val(),
            summary: ('[summary=summary]').val()
        }, function (data) {
            if (data.success) {
                $('div#didIt').slideDown('slow');
            } else {
                alert('Failed SA!');
            }
        }, 'json');
        return false;
    });
});

Below is what the code for project_ajax.php...

if($_POST['action'] == "update") {
    //Prep the field for Query Entry!-----------------------------------
    $pId     = $_POST['pId'];
    $name    = trim(mysql_prep($_POST['name']));
    $status  = 1;
    $url     = trim(mysql_prep($_POST['url']));
    $tumb    = false; //False because I still need to make a script for it.
    $summary = trim(mysql_prep($_POST['summary']));
    $creater = $_SESSION['userId'];
    $created = date("Ymd");

    $q = "UPDATE " . DB_NAME . ".`projects` SET 
                    name    = '{$name}',
                    status  = '{$status}',
                    url     = '{$url}',
                    summary = '{$summary}',
                    creater = '{$creater}',
                    created = '{$created}'
              WHERE `projects`.`id` = {$pId}";
    $r = mysql_query($q, $connection);
    if ($r) {
        //Successful
        $data['success'] = true;
        $date['error']   = false;
        $date['message'] = "You are the Greatest!";

    } else {
        //Fail
        $data['success'] = false;
        $data['error']   = true;
        $date['message'] = "You can't do it fool!";

    }

} else {
    $data['success'] = false;
    $date['error']   = true;
    $data['message'] = "You Failed Stupid!";
}

echo json_encode($data);

Note: When load this page. The browser never really finsh loading. The the blue-ring on the title tab within IE8 spins as if the page never finsh loading.

8
  • Have you tested this in other browsers? It could be that it only fails in IE8. Also check if you get any JavaScript errors, which causes the code to fail (for example a syntax error, or something is undefined, etc). Check that the jQuery selector selects the right form.
    – Marius
    Dec 6, 2009 at 23:39
  • 1
    Your PHP code looks like it is prone to SQL Injection attacks. Guess what happens if the user sends a pId with value 123; DROP TABLE some_table. See en.wikipedia.org/wiki/SQL_injection for a description of the problem and several solutions for PHP Dec 6, 2009 at 23:50
  • Well, I do believe my code is prone to SQL Injections. However I dont believe "pId" is one. Only because pId is a hidden value that is pulled from a database. Unless user can change hidden values? Can they change hidden values?
    – SgtOJ
    Dec 7, 2009 at 0:11
  • you assign a value from $_POST to $pId without escaping or typecasting it. If projects.id is an integer, you could cast it to an int ($pId = (int) $_POST['pId'];). But $pId isn't the only problem, so my suggestion is to move away from the mysql_* functions and use something like PDO (php.net/manual/en/book.pdo.php) that supports prepared statements. Dec 7, 2009 at 0:22
  • And to answer the question in your comment: yes, the user can change hidden values before sending them to your server. Basically, everything that comes from the user should be treated as potentially malicious data. It's an ugly world we live in... Dec 7, 2009 at 0:29

1 Answer 1

4

On this line:

  summary: ('[summary=summary]').val()},

You have a missing $ which represents the jQuery function. Corrected:

summary: $('[summary=summary]').val()},

Because you have a Javascript error, the execution is terminated. Thus the loading takes forever.

2
  • Thanks. This fixed an error, but still that script doesn't work.
    – SgtOJ
    Dec 7, 2009 at 0:27
  • Thanks. Figured out what was wrong beside the missing "$"... The other problem was the '/' at "$.post('/project_ajax.php', {"
    – SgtOJ
    Dec 7, 2009 at 1:12

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.