I'm trying to create a sorting/order mechanism for posts on my website, either sorting by newest or hotest. I have a HTML <select>
element on my frontpage.php that triggers via a jQuery onChange
to save the selected options value into a variable. It then runs a GET request to the file feed.php with the value of the selected option. This dosen't now show anything. The error: Notice: Undefined index: order
in the feed.php file.
<select id="order">
<option value="published">Newest</option>
<option value="votes">Hottest</option>
</select>
The jQuery that checks for a change and then saves the select #order
childs value in the variable selected
.
$('#order').change(function() {
var selected = $(this).children("option:selected").val();
$.ajax({
type: 'GET',
data: {order: selected},
url: '../../php/includes/posts/feed.php'
});
});
Then I have the PHP script (feed.php) that outputs the posts with a while-loop (not included in this question.) The while-loop works as it should otherwise. I would want to change the order of the SQL table asynchronously.
$order = $_GET['order'];
if(isset($order)) {
$sql = "SELECT * FROM posts ORDER BY '$order' DESC LIMIT 0, 5";
$results = $conn->query($sql);
// The php script continues but it works as it should without the code above of course.
Is this maybe due to that the $order isn't saved before use on feed.php?
EDIT:
This is the entire code for feed.php I've now changed the code for bth feed.php and my jQuery script to include the changes that were given
if(isset($order)) {
$order = $_GET['order'];
$sql = "SELECT * FROM posts ORDER BY `$order` DESC LIMIT 0, 5";
$results = $conn->query($sql);
if ($results->num_rows > 0) {
while($row = $results->fetch_assoc()) {
$postID = $row['postID'];
$author = $row['author'];
//$img = $row['fileName'];
$published = strtotime($row['published']);
echo '
<div class="post">
<div class="post__head">
<div>
<h6>'.$row['title'].'</h6>
<p> <i class="far fa-user"></i> '.$author.'</p>
<p> <i class="far fa-clock"></i> '.date("j.n.Y - H:i:s", $published).'</p>
</div>
<div class="post__votes">
<p>'.$row['votes'].' Votes</p>
<i data-id="'.$postID.'" class="fas fa-arrow-up -upvote"></i>
<i data-id="'.$postID.'" class="fas fa-arrow-down -downvote"></i>
</div>
</div>
<div class="post__body">
<div class="post__img">
</div>
<p>'.$row['message'].'</p>
<div class="post__comments">
<p>Comments</p>';
$sqlComments = "SELECT * FROM comments WHERE comments.postID = $postID"; // Loop through all comments for a given post
$resultsComments = $conn->query($sqlComments);
if($resultsComments->num_rows > 0){
while($row = $resultsComments->fetch_assoc()) {
echo $row['comment'] . '<br>';
}
} else {
echo 'No comments yet...';
}
echo'
</div>
</div>
<div class="post__footer">';
if(isset($_SESSION["loggedin"])) {
$role = $_SESSION['role'];
if($role == 'admin' || $role == 'editor' || $author == $_SESSION['username']) { # Edit posts only if logged in and as a either admin, editor or as the user who created the post
echo '
<button type="button" class="post__editBtn" data-id="'.$postID.'">Edit <i class="fas fa-pencil-alt"></i></button>
<button type="button" class="post__commentBtn" data-id="'.$postID.'">Comments <i class="fas fa-comments"></i></button>';
}
if($role == 'admin' || $author == $_SESSION['username']) { # Delete posts only if logged in as a admin or the author of the post
echo'
<form method="post">
<input type="hidden" value="'.$postID.'" name="post__deleteHidden">
<button name="post__deleteBtn">Delete <i class="far fa-trash-alt"></i></button>
</form>';
}
}
echo'</div>
</div>';
}
echo '
<div class="overlay-edit">
<p>Editing </p>
<form method="post" action="../../php/includes/posts/editPost.php" class="post__edit">
<input type="text" name="postTitle" placeholder="Edit title">
<textarea name="postMsg" maxlength="255" placeholder="Edit message"></textarea>
<button type="submit">Edit Post</button>
<button type="button" class="post__edit-close">Close</button>
<input type="hidden" name="post__editHidden" value="">
</form>
</div>';
echo'
<div class="overlay-comment">
<form method="post" action="../../../php/includes/posts/createComment.php" class="post__comment">
<textarea name="comment" maxlength="255" placeholder="Comment"></textarea>
<button type="submit">Submit comment</button>
<button type="button" class="post__comment-close">Close</button>
<input type="hidden" name="post__commentHidden" value="">
</form>
</div>';
if(isset($_POST['post__deleteBtn'])) { # Delete a post
$conn->query("DELETE * FROM posts WHERE postID = ".$_POST['post__deleteHidden']."");
}
} else {
echo '<p>No posts to show...</p>';
}
}
$conn->close();
?>
data: "order="+selected,
and do not forget to prepare/bind/exec at server side to avoid SQL injections'$order'
< remove the quotes from that. We're dealing with a column and not a string value from in db.