0

I'm trying to insert a user into a database using jQuery and PHP. The PHP file itself has been tested seperately and works fine, the javascript variables before the ajax request work fine as well.

Any help is greatly appreciated!

ajax.js

$(document).ready(function(){

$("#add-user-btn").click(function() {

var email = $("#email").val();
var name = $("#name").val();
var password = $("#password").val();
var pass = hex_sha512(password);
var random_number = Math.floor((Math.random()*1000)+1);
var salt = hex_sha512(random_number);
var p = hex_sha512(pass+random_number);
var action = "adduser";

$(function () 
{
$.ajax({          
  url: '../actions.php',                  
  type: 'POST',          
  data: {
      action:action,
      email:email,
      name:name,
      password:p,
      salt:salt,
      authorization:authorization
      },                        
  dataType: 'json',               
  success: function(data)         
  {
      $(".close-reveal-modal").click();
  }
});
});
});
});

actions.php

if($_POST['action'] == "adduser"){
$email = $_POST['email'];
$name = $_POST['name'];
$password = $_POST['password'];
$salt = $_POST['salt'];
$domain = "level";
$authorization = $_POST['authorization'];

$query = "INSERT INTO users (email, username, password, salt, domain, level) VALUES ('$email', '$name', '$password', '$salt', '$domain', '$authorization')"; 
$mysqli->query($query);
}

Also tried adding the following at the end of the PHP file, but to no avail.

$resp = new stdClass();
$resp->success = false;
if($result) {
    $resp->success = true;
}

print json_encode($resp);
Jenszor
  • 89
  • 2
  • 3
  • 9
  • 2
    WOW ... you just taking user input and inserting it into a database using string concatenation ... [have a read of this (sql injection)](http://stackoverflow.com/questions/60174/how-to-prevent-sql-injection-in-php) – Manse Jul 25 '13 at 16:45
  • try to log the output on success to console `console.log(data)` and see if there is any response. also I think that part with salt and hex should happen in PHP file.. – Kamil Jul 25 '13 at 16:47
  • 2
    Have you used a browser debugger to find out what happens when you POST data ? is it being sent ? what errors are you getting ? – Manse Jul 25 '13 at 16:47
  • try to track your AJAX requests using Network->XHR tab in firebug plugin in firefox and see what data is getting passed to the php page. – Maximus2012 Jul 25 '13 at 16:49
  • @ManseUK Look I'm not bothering with prepared statements in a testing phase. Trust me, by the time this code finds it way online it will be sufficiently protected against SQL injections. – Jenszor Jul 25 '13 at 16:49
  • But anyway is there any response from the script logged to console? What is stored in `data` variable? – Kamil Jul 25 '13 at 16:50
  • Also try to print the `$_POST` array to see that values are passed correctly. – Kamil Jul 25 '13 at 16:52
  • The console doesn't report anything about the script. The data variable only contains varchars. – Jenszor Jul 25 '13 at 16:54
  • I would do the password encryption stuff on the server side. As long as you are sending the password to the back end via https then there is no need to make it easier for nefarious users by showing them exactly what your doing. firebug is also a good plugin to see what data is being sent in an ajax request. – Drew Jul 25 '13 at 16:55
  • even when you print `$_POST` array at the end of the PHP file? so maybe there is an error in some previous lines of PHP file? – Kamil Jul 25 '13 at 16:56
  • @Drew, no https available on the server (not mine). So doing it this way seems like less of a threat to me than sending an unencrypted password over POST. I'm going to check what firebug reports now. – Jenszor Jul 25 '13 at 16:57
  • @Kamil, yes indeed. And that's the only PHP in the file. – Jenszor Jul 25 '13 at 17:01
  • Is it just me or the `authorization` value was not set in JavaScript? Probably the PHP script is throwing an undefined variable error which you are not seeing. – federico-t Jul 25 '13 at 17:14
  • Update: nothing is getting passed to the php file after tracking it with firebug. My (working) script for user deletion however, works as it is supposed to (can't find apparent differences in the code though). @Campari I'll try to narrow it down by removing all but one variable at a time. – Jenszor Jul 25 '13 at 17:16
  • @Jenszor Why don't you add a line `var authorization = "whatever"`; before using it in the [`$.ajax`](http://api.jquery.com/jQuery.ajax/) function? My guess is that the problem is that you are using an undefined variable in JavaScript. – federico-t Jul 25 '13 at 17:20
  • @Campari, you are absolutely correct. That solved it. I looked through the code a hundred times already and just kept looking over it! Silly mistake. Thanks for the help! – Jenszor Jul 25 '13 at 17:22

0 Answers0