JavaScript PHP $_Get issue

Question

so I have a JavaScript function which calls to a PHP file using an asyncronous method. This is my code

JavaScript

var xmlHttp = new XMLHttpRequest();
xmlHttp.onreadystatechange = function() { 
    if (xmlHttp.readyState == 4 && xmlHttp.status == 200)
        callback (xmlHttp.responseText);
}
xmlHttp.open("GET", "http://127.0.0.1/formulario/insertReporte.php?"+'nombreAlumno='+nombreAlumno+'&noCta='+noCta+'&semestre='+semestre, true);
xmlHttp.send(null);

And here is my PHP File

<?php

$servername = "myServerName";
$username = "myUserName";
$password = "myPassWord";
$dbname = "myDb";

$nombreAlumno = $_GET['nombreAlumno'];
$noCta = intval($_GET['noCta']);
$semestre = intval($_GET['semestre']);

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
} 

$sql = "INSERT INTO infoalumno (nombreAlumno,noCta,noSemestre)
VALUES ($nombreAlumno,$noCta,$semestre)";

if ($conn->query($sql) === TRUE) {
    $last_id = $conn->insert_id;
    echo $last_id;
} else {
    echo "Error: " . $sql . "<br>" . $conn->error;
}

$conn->close();
?>

My issue comes on this line $nombreAlumno = $_GET['nombreAlumno']; as I get this error

On my database my nombreAlumno field is declared as a varchar.

I know my connection works because if I change that line into $nombreAlumno = intval($_GET['nombreAlumno']); it inserts 0 into my database.

Any ideas what am I doing wrong?

omar is a string put it into 'omar' (single quot)

Domain
– Domain

2015-10-19 05:44:06 +00:00
Commented Oct 19, 2015 at 5:44 — Domain
– Domain, Commented Oct 19, 2015 at 5:44

Saty · Accepted Answer · 2015-10-19 05:38:03Z

3

You need to add quotes around your values. Also use mysqli_real_escape_string before insert into database to prevent sql injection

$nombreAlumno=mysqli_real_escape_string($conn, $nombreAlumno);
$noCta=mysqli_real_escape_string($conn, $noCta);
$semestre=mysqli_real_escape_string($conn, $semestre);

$sql = "INSERT INTO infoalumno (nombreAlumno,noCta,noSemestre)
VALUES ('".$nombreAlumno."','".$noCta."','".$semestre."')";

answered Oct 19, 2015 at 5:38

Saty

22.5k7 gold badges35 silver badges52 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Omaruchan Over a year ago

Do I add real_escape_string even if my variables $noCta and $semestre are ints?

Saty Over a year ago

yes why not!! always use mysqli_real_escape_string before insert into datanase

Omaruchan Over a year ago

So, I did that and now its not inserting anything into the database nor throwing any errors.

Saty Over a year ago

echo

$sql = "INSERT INTO infoalumno (nombreAlumno,noCta,noSemestre) VALUES ('".$nombreAlumno."','".$noCta."','".$semestre."')";

and check your query

Omaruchan Over a year ago

Seems it was just my server being weird, restarted it and it works now, thank you very much! Edit: Just got 15 reputation so I'm definitely upvoting. :)

Sandeep Nambiar · Accepted Answer · 2015-10-19 05:37:31Z

0

Try this

<?php

$servername = "myServerName";
$username = "myUserName";
$password = "myPassWord";
$dbname = "myDb";

$nombreAlumno = $_GET['nombreAlumno'];
$noCta = intval($_GET['noCta']);
$semestre = intval($_GET['semestre']);

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
} 

$sql = "INSERT INTO infoalumno (nombreAlumno,noCta,noSemestre)
VALUES ('".$nombreAlumno."','".$noCta."','".$semestre."')";

if ($conn->query($sql) === TRUE) {
    $last_id = $conn->insert_id;
    echo $last_id;
} else {
    echo "Error: " . $sql . "<br>" . $conn->error;
}

$conn->close();
?>

answered Oct 19, 2015 at 5:37

Sandeep Nambiar

1,6764 gold badges23 silver badges40 bronze badges

Collectives™ on Stack Overflow

JavaScript PHP $_Get issue

2 Answers 2

5 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

5 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related