0

I am using DataTables, but it is causing an error, and I cannot find where the error is.

I want to use server-side processing, because after inserting 11k Rows, it's lagging.

Error

The code I am using:

<?php
/* Database connection start */
$servername = "localhost";
$username = "root";
$password = "";
$dbname = "accounts";

$conn = mysqli_connect($servername, $username, $password, $dbname) or die("Connection failed: " . mysqli_connect_error());

/* Database connection end */


// storing  request (ie, get/post) global array to a variable  
$requestData= $_REQUEST;


$columns = array( 
// datatable column index  => database column name
    0 =>'type', 
    1 => 'country',
    2 => 'information',
    3 => 'seller',
    4 => 'price'
);

// getting total number records without any search
$sql = "SELECT type, country, information, seller, price ";
$sql.=" FROM accounts WHERE type2='1'";
$query=mysqli_query($conn, $sql) or die("employee-grid-data.php: get employees");
$totalData = mysqli_num_rows($query);
$totalFiltered = $totalData;  // when there is no search parameter then total number rows = total number filtered rows.


$sql = "SELECT type, country, information, seller, price ";
$sql.=" FROM accounts WHERE type2='1' AND 1=1";
if( !empty($requestData['search']['value']) ) {   // if there is a search parameter, $requestData['search']['value'] contains search parameter
    $sql.=" AND ( type LIKE '".$requestData['search']['value']."%' ";    
    $sql.=" OR country LIKE '".$requestData['search']['value']."%' ";

    $sql.=" OR information LIKE '".$requestData['search']['value']."%' )";

        $sql.=" OR seller LIKE '".$requestData['search']['value']."%' )";

}
$query=mysqli_query($conn, $sql) or die("employee-grid-data.php: get employees");
$totalFiltered = mysqli_num_rows($query); // when there is a search parameter then we have to modify total number filtered rows as per search result. 
$sql.=" ORDER BY ". $columns[$requestData['order'][0]['column']]."   ".$requestData['order'][0]['dir']."  LIMIT ".$requestData['start']." ,".$requestData['length']."   ";
/* $requestData['order'][0]['column'] contains colmun index, $requestData['order'][0]['dir'] contains order such as asc/desc  */    
$query=mysqli_query($conn, $sql) or die("employee-grid-data.php: get employees");

$data = array();
while( $row=mysqli_fetch_array($query) ) {  // preparing an array
    $nestedData=array(); 

    $nestedData[] = $row["type"];
    $nestedData[] = $row["country"];
    $nestedData[] = $row["information"];
        $nestedData[] = $row["seller"];
    $nestedData[] = $row["price"];


    $data[] = $nestedData;
}



$json_data = array(
            "draw"            => intval( $requestData['draw'] ),   // for every request/draw by clientside , they send a number as a parameter, when they recieve a response/data they first check the draw number, so we are sending same number in draw. 
            "recordsTotal"    => intval( $totalData ),  // total number of records
            "recordsFiltered" => intval( $totalFiltered ), // total number of records after searching, if there is no searching then totalFiltered = totalData
            "data"            => $data   // total data array
            );

echo json_encode($json_data);  // send data as json format

?>

I am not finding any solutions.

The error that is showing on PHP file

Image

Offir
  • 3,252
  • 3
  • 41
  • 73
  • Do I see SQL injection vulnerability? – Gurwinder Singh Dec 25 '16 at 17:46
  • Yes I think so. It's from this code I got from google. –  Dec 25 '16 at 17:48
  • Please always post your errors as text, not images. If you can replace the above when you next sign in, that would be great. You will see that this question has been asked before, in the "Related" sidebar ([for example, here](http://stackoverflow.com/q/4261133/472495)). – halfer Dec 27 '16 at 18:25

1 Answers1

2

$requestData does not have start and order keys, so use isset() or empty() functions to check if they are not empty, then only use them.

For example:

LIMIT " . (empty($requestData['start']) ?
    'whatever you want to put default value' :
    $requestData['start'])
halfer
  • 19,824
  • 17
  • 99
  • 186
Sneha Maheshwari
  • 419
  • 1
  • 3
  • 7