0

I was working ajax with my php code. I just want to retrieve some values from the database. So what i am doing is, when i click on the edit button i am getting its id using that i am passing through ajax and retrieve the value from mysql.

my Html code:

   <a class="edit_address_book" style='float:right;' id="<?= $list['address_key'] ?>">Edit</a>

jquery:

 $(document).on("click", ".edit_address_book", function(){
  $(".address_book").hide();
  $key = $(this).attr("id");
  alert($key); //printing agagaga
  $param = {address_key: $(this).attr("id")};
  $.ajax({
      url: "<?= BASE_URL ?>/users/get_address_book.html",
      type: "POST",
      data: ($param),
      success: function(data){
        alert(data);
        //window.reload();
      },
      error: function(xhr){
        alert("error " + xhr.status);
      }
  });

PHP

 $key = $_POST['address_key'];
        $query = Yii::$app->DB->createCommand("SELECT address_key, flat_no, apartment, address, company, delivery_instruction, alternate_contact WHERE address_key =". mysql_real_escape_string(mysql_real_escape_string($key)));
        //$query->bindValue(":key", mysql_real_escape_string($key));
        $result = $query->queryOne();

when i am seeing the in my console i got this error

Exception (Database Exception) 'yii\db\Exception' with message 'SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE address_key =sfdsewrffdsfds' at line 1 The SQL being executed was: SELECT address_key, flat_no, apartment, address, company, delivery_instruction, alternate_contact WHERE address_key =sfdsewrffdsfds&#039//it showing this single quote as html entity;

please someone help me

Sivabalan
  • 971
  • 2
  • 18
  • 43

1 Answers1

1

You need to wrap your SQL data in single quotes. You're also double escaping the data

$query = Yii::$app->DB->createCommand("SELECT address_key, flat_no, apartment, address, company, delivery_instruction, alternate_contact WHERE address_key ='". mysql_real_escape_string($key) . "'");

And last but not least, stop using mysql_ functions

Community
  • 1
  • 1
Machavity
  • 30,841
  • 27
  • 92
  • 100