Jquery Mobile - form submission - Error Loading Page

Question

I submit a form like so:

<form action="userlogin.html" method="get" name="log_form" onsubmit="return form_val();">

which is all good, then it goes to produce the cookie if log in data correct as follow:

if ($email){ // 111
    require '/php/lib/dbconnect.inc';
    $email=strtolower($email);
    $password=strtolower($password);
    $result = mysql_query("SELECT name from users where (username = '$email' AND password = '$password')",$db); 
    if(!$result) { echo mysql_error(); exit; } // debug
    $item = mysql_fetch_row($result);
    $result_userid = mysql_query("SELECT user_id from users where (username = '$username' AND password = '$password')",$db); 
    if(!$result_userid) { echo mysql_error(); exit; } // debug
    $item_userid = mysql_fetch_row($result_userid);
    if ('0'==$item[0]){ // 33
    $error .= "You typed the wrong email address or password, please check the information entered.<br><br><br>";
    } // close 33
    else { // 44
    require '/php/lib/setup.inc';
    $user = Encrypt_data ($item_userid[0]);
    setcookie("user_cook", "$user", 0);
    header("Location: /en/");
    } // close 44
    } // close 111

But I always get "error loading page" whether data input is correct or not, therefore something is not right but what?

Also, I have tried adding my header include file into this so therefore passing the jQuery Mobile tags before assessing if the data is correct which does work but then of course I cannot use header("Location: /en/");

So I guess to clarify, this all works OK and the form is passing the data but it seems as if jQuery needs something before it will look at other data... the following works:

if ($email){ // 111
    include '/home/twovo77/1NTJ3EJZ/php/nav/mobile_header.inc';
    // require '/home/twovo77/1NTJ3EJZ/php/lib/dbconnect.inc';
    $email=strtolower($email);
    $password=strtolower($password);

but is no good as its passing to the header

mobile_header.inc is:

<? 
require '/php/lib/setup.inc';
require '/php/lib/dbconnect.inc'; ?>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> 
<html> 

<head>
<meta charset="utf-8">
<meta name="viewport" content='width=device-width, initial-scale=1.0, maximum-        scale=1.0, min-width=321px'>
<link rel="stylesheet" href="mobile.css" />

<script src="http://code.jquery.com/jquery-1.6.4.min.js"></script>
<script src="http://code.jquery.com/mobile/1.0rc2/jquery.mobile-.0rc2.min.js">
</script>

</head> 

<body> 

<div data-role="page" id="foo" data-title="<? echo $page_title; ?>">

<a href="index.html"><div data-role="header" data-theme="c" style="height:50px; padding:3px;"><img src="/images/logo2.png"></div></a><!-- /header -->

<? echo $header_image; ?>

<div data-role="content"><div class="inner">

So is there some tag in there that has to be passed otherwise you get error loading page

or, more importantly, can i bypass this while i execute my log in code then go back to it...if so, how?

Jasper · Accepted Answer · 2011-11-18 19:48:05Z

Try using an absolute URL for your form action (I haven't quite figured it out but the base element seems to be a bit wacky with jQuery Mobile). When I get that error I look at Firebug to see where the request was being made to and normally it will be a relativity issue with the current page and the location of the action.

For instance if you start at the root directory ("/") and grab a page from the "/gallery/" directory that has a relative URL to another file inside the "/gallery/" directory then once it's pulled into the DOM (at the "/" level) any relative URLs won't match up.

On a side note it does not appear as though you are escaping your data before querying the database which makes injection attacks possible:

Change:

"SELECT name from users where (username = '$email' AND password = '$password')"

And

"SELECT user_id from users where (username = '$username' AND password = '$password')"

To:

"SELECT name from users where (username = '" . mysql_real_escape_string($email) . "' AND password = '" . mysql_real_escape_string($password) . "')"

And

"SELECT user_id from users where (username = '" . mysql_real_escape_string($username) . "' AND password = '" . mysql_real_escape_string($password) . "')"

Otherwise someone can enter a username like:

$username = "' OR 'x'='x";

Which makes your query look like this (and resolve to true):

"SELECT name from users where (username = '' OR 'x'='x' AND password = '$password')"

Here is the PHP documentation for mysql_real_escape_string: http://php.net/mysql_real_escape_string

Collectives™ on Stack Overflow

Jquery Mobile - form submission - Error Loading Page

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related