using json to update mysql database blank fields

Question

I'm trying to insert records into a mysql db but the fields are blank. Here is my js:

$("#submit").click(function() { 
    var product1name     = $("input#product1name").val();
    var product2name     = $("input#product2name").val();
    var product3name     = $("input#product3name").val();
    var product4name     = $("input#product4name").val();
    var product5name     = $("input#product5name").val();
    var product1quantity = $("input#product1quantity").val();
    var product2quantity = $("input#product2quantity").val();
    var product3quantity = $("input#product3quantity").val();
    var product4quantity = $("input#product4quantity").val();
    var product5quantity = $("input#product5quantity").val();

    var dataString = 'product1name='+ product1name + 'product2name=' + product2name + 'product3name=' + product3name + 'product4name=' + product4name + 'product5name=' + product5name + 'product1quantity='+ product1quantity + 'product2quantity='+ product2quantity + 'product3quantity='+ product3quantity + 'product4quantity='+ product4quantity + 'product5quantity='+ product5quantity + 'salesid='+ salesid + 'email='+ email + 'wpuseremail='+ wpuseremail;

    $.ajax({  
      type: "POST",
      url: "process.php",
      data: dataString,
      success: function(json) {  
        $('#contact_form').html("<div id='message'></div>");
        $('#message').html(json.type)
        .append(json.message)
        .hide()
        .fadeIn(1500, function() {
          $('#message').append("<img id='checkmark' src='images/check.png' />");
        });
      }
    });
    return false;

});

Here is my php:

<?php
$product1quantity = $_POST["product1quantity"];
$product2quantity = $_POST["product2quantity"];
$product3quantity = $_POST["product3quantity"];
$product4quantity = $_POST["product4quantity"];
$product5quantity = $_POST["product5quantity"];

$username = "user";
$password = "pass";
$hostname = "host"; 

$dbhandle = mysql_connect($hostname, $username, $password)
 or die("Unable to connect to MySQL");

$selected = mysql_select_db("dbname",$dbhandle)
  or die("Could not select dbname");

$result = "INSERT INTO dbname.tablename (product1name, product2name, product3name, product4name, product5name, product1quantity, product2quantity, product3quantity, product4quantity, product5quantity, id) VALUES ('', '', '', '', '', product1quantity, product2quantity, product3quantity, product4quantity, product5quantity, NULL)";
mysql_query($result);

mysql_close($dbhandle);

$response = array('type'=>'', 'message'=>'');
$response['type'] = 'success';
$response['message'] = 'Thank-You for submitting the form!';
print json_encode("success");
?>

I've confirmed that it works when i do NOT use variables in the INSERT statement, but rather hardcoded values. Something seems wrong with my variables.

have you tried any basic debugging, e.g a var_dump($_POST)? — Marc B
– Marc B, Commented May 14, 2013 at 21:41

reikyoushin · Accepted Answer · 2013-05-14 21:33:20Z

3

seems your so called variables doesnt have $ in front of them..

see

$result = "INSERT INTO dbname.tablename (product1name, product2name, product3name,     product4name, product5name, product1quantity, product2quantity, product3quantity, product4quantity, product5quantity, id) VALUES ('', '', '', '', '', $product1quantity, $product2quantity, $product3quantity, $product4quantity, $product5quantity, NULL)";

but please fix your code because it is highly risky to insert directly from POST variables because of SQL injection security vulnerabilities

you can consider using prepared statements like PDO or mySQLi

read more here: http://net.tutsplus.com/tutorials/php/why-you-should-be-using-phps-pdo-for-database-access/

answered May 14, 2013 at 21:33

reikyoushin

2,0212 gold badges24 silver badges42 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

the robert Over a year ago

Thanks @reikyoushin - my json datastring was also wrong. It should be: var dataString = 'product1name='+ product1name + '**&**product2name=' + prod.... and I'll most certainly take your advice on mySQLi!!

bfavaretto · Accepted Answer · 2013-05-14 22:24:12Z

1

I think you missed the dollar sign on your variables ($).

you should write :

$result = "
    INSERT INTO dbname.tablename (
        product1name, 
        product2name, 
        product3name, 
        product4name, 
        product5name, 
        product1quantity, 
        product2quantity, 
        product3quantity, 
        product4quantity, 
        product5quantity, 
        id
    ) VALUES (
        '', 
        '', 
        '', 
        '', 
        '', 
        $product1quantity, 
        $product2quantity, 
        $product3quantity, 
        $product4quantity, 
        $product5quantity, 
        NULL
    )
";

edited May 14, 2013 at 22:24

bfavaretto

72k18 gold badges118 silver badges162 bronze badges

answered May 14, 2013 at 21:36

Fouad Fodail

2,6431 gold badge18 silver badges16 bronze badges

Collectives™ on Stack Overflow

using json to update mysql database blank fields

2 Answers 2

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related