Updating SQL database using jQuery Ajax and PHP

Question

So i am trying to use ajax to update a value in my sql database by grabbing the link that was clicked and finding that link in the database. I'm not sure why it isn't working :\

$('.visit').click( function() {
var thisLink = $(this).attr('href'); 
$.post("visit.php", { link: thisLink});
});

<?php
$link = $_POST['link'];
mysql_query("UPDATE items SET visited = 1 WHERE link = $link");
include("print.php");
?>

Also take a look at the 'bind-param' method. You currently have a situation where someone could post to the following url and cause issues. yoursite.com/visit.php?link='data;DROP TABLE [items]' — rcravens
– rcravens, Commented Mar 7, 2011 at 1:31
@rcravens right I understand. How would I modify this code using that? — redenvy
– redenvy, Commented Mar 7, 2011 at 1:37

rcravens · Accepted Answer · 2011-03-07 01:43:42Z

2

To prevent the SQL injection use something like the following (typed from memory...double check).

<?php
    $db = new PDO('connection string', 'username', 'password');

    $query = "UPDATE items SET visited=1 WHERE link=:link";

    $stmt = $db->prepare($query);
    $stmt->execute(array(':link' => $link));
?>

Bob

answered Mar 7, 2011 at 1:43

rcravens

8,3982 gold badges35 silver badges27 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

KJYe.Name Over a year ago

adding PDO support is php5 (PHP 5 >= 5.1.0, PECL pdo >= 0.1.0) or PECL

rcravens Over a year ago

@kjy112 good point. Thanks for the example using mysql_real_escape_string.

KJYe.Name · Accepted Answer · 2011-03-07 01:44:20Z

2

    $('.visit').click( function() {
         var thisLink = $(this).attr('href'); 
         $.post("visit.php", { link: thisLink});
    });

    <?php
         $link = $_POST['link'];
         mysql_query("UPDATE items SET visited = '1' WHERE link = '".mysql_real_escape_string($link)."'");
         include("print.php");
    ?>

use single quote around SET and WHERE params. Also, mysql_escape_real_string inputs into database for SQL injection

answered Mar 7, 2011 at 1:44

KJYe.Name

17.2k5 gold badges51 silver badges63 bronze badges

Comments

bensiu · Accepted Answer · 2011-03-07 01:35:42Z

1

 <?php 
  $link = $_POST['link']; 
  mysql_query("UPDATE items SET visited = 1 WHERE link = '$link'"); 
  include("print.php"); // what print.php does ?
 ?>

put quotes around $link

compare $link with value in database field - it need to be exaclly match

edited Mar 7, 2011 at 1:35

answered Mar 7, 2011 at 1:23

bensiu

25.7k56 gold badges81 silver badges117 bronze badges

4 Comments

Greg Flynn Over a year ago

this is the only problem I can see also

redenvy Over a year ago

hmm yeah that didn't seem to work. I am checking the database and it isn't getting updated. My table is called items and the row is called link. Is my sql syntax right? Also the print.php just prints out the html

bensiu Over a year ago

about print.php - your jQuery post seems to not care about return - so it wasting of CPU to produce it

redenvy Over a year ago

well what im trying to do is repost the html and if the link has already been visited i was going to attach a css class to it to demonstrate that. So the print.php does that.

Collectives™ on Stack Overflow

Updating SQL database using jQuery Ajax and PHP

3 Answers 3

2 Comments

Comments

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

Comments

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related