Is it possible to store a list item name into a variable that can be used in an SQL query?

Question

I am trying to grab the text in a list item that a user clicks on and then store it in a variable. I would then use that variable as a search term in an sql query. I would like to know if it is possible to do this.

I think I have most of the code written, I'm just confused on how to make all of the files work together.

Jquery script to change class names to whatever text the user clicks on:

$('li').click(function () {
    var name = $(this).text(); 
    var sqlname = name;
    $('#prf').attr("class",name);
    $('#pic').attr("class",name);
    $('#info').attr("class",name);

 });

SQL Code within a PHP document to search a MyPHPAdmin database for whatever value 'stagename' is equal to.

<?php

$link = mysqli_connect("host", "username", "pass","db_name") or die ("Error ". mysqli_error($link));

$query = "SELECT realname
           FROM artistmaster
           WHERE stagename = '**jQuery variable here**'";

        $result = mysqli_query($link, $query)  or die(mysqli_error($link));         

        $row = mysqli_fetch_assoc($result);

        foreach($row as $key => $value) {
                        $$key = $value;
                        } ;
        echo $realname;
?>

EDIT: I already have the MyPHPAdmin setup, and I have already created a database with the necessary data. (all stagenames and realnames of each artist)

So basically the user clicks on a list item that has the stage-name of musical artist, the stage-name then gets ran through an sql query that returns the real name of the musician.

I'm fairly new to programming in general, and have just started learning HTML, PHP, and JQuery within the past week. That being said, If i'm over-complicating this somehow or if anyone has a suggestion on how to simply if this, that would be great.

Try using JSON.stringify(var) and send that to the php via ajax — Akxe, Jun 12 '14 at 21:58
Read http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php?rq=1 and fix the code before continuing with work. — user2864740, Jun 12 '14 at 22:03
PHP scripts run on the server only, before the user gets to see or interact with the page. The only way the user interacting with a web page form, or other element on the page, can activate a PHP script is by an HTTP POST or GET request. This means actions such as submitting a form or clicking a link. There's two ways to POST and GET, one is to reload the page, the other is to use AJAX (also called XHR), which does not reload the page. When using AJAX, the PHP script doesn't have direct access to the page, you'll need to send data back through the AJAX function to jQuery or Javascript. — bloodyKnuckles, Jun 12 '14 at 22:07

score 0 · Accepted Answer · answered Jun 12 '14 at 22:03

What you're attempting to do here has been done many, many times before, so don't think you're trying to reinvent the wheel! The general premise is something like this:

User clicks a button/link/whatever
The jQuery sends an AJAX request to the PHP server using GET or POST methods. For GET, the parameters are in the query string (e.g. ?val1=1&val2=2). For POST, the values will be stored in the body of the message, represented in jQuery $.ajax by the data field.
The PHP page will make the mysqli call to the database based off of what was in the $_GET[] or $_POST[] variable (depending on if you used get or post). This is where things like SQL Injection prevention (i.e. parametariazation) are extremely important.
The PHP page returns results, normally as JSON (javascript object notation), but technically can be anything that you will eventually interpret with JSON
The JSON call takes the results returned and does what you need it to do with them

There's a few technologies involved there, but the general idea is that the client (jQuery) cannot talk to the database directly, it has to go through the server. The use of AJAX makes it possible to do so 'on-the-fly' without having to reload the page.

If nothing I mentioned in this post makes any sense, I'd encourage you to spend some time reading up not only on documentation, but tutorials and examples. This type of setup is, some would say, the core to web development in today's world. It's a bit much to understand, yes, but once you do web programming makes a lot more sense.

Thanks a lot for the response. I was really just looking for somewhere to start and this is perfect. I'll definitely be reading up on the documentation and SQL Injection prevention. — Steve, Jun 12 '14 at 23:41

Is it possible to store a list item name into a variable that can be used in an SQL query?

1 Answers1