JavaScript To Pass Parameter To PHP And Run Query

Question

I am attempting to pass a parameter from javascript to a php file, use the parameter in my Where clause in the php file and echo the results back to the calling page. Nothing is returned, and I am not sure if the issue lies in the javascript or the php.

This is what I have
PHP

$state = $_POST['state'];

$con = mssql_connect('Server','userid','pwd') 
    or die('Could not connect to the server!');

mssql_select_db('Partner') 
    or die('Could not select a database.');

$SQL = "SELECT * FROM [Table] WHERE [state] = '". $state. "'";

$result = mssql_query($SQL) or die('A error occured: ' . mysql_error());

echo $result

JavaScript (at least the relevant portion)

var name="TX"
xhr.open("GET", "Test.php?state="+name, true);

What needs to be changed in either the php file or the javascript so that this will properly return the value? It is valid sql as if I run the string in SSMS it returns properly. (yes it is 2 digit states being stored in the database also)

EDIT
I am reading the response like so

xhr.onreadystatechange = function(){ if (xhr.readyState == 4 && xhr.status==200)
{ document.getElementById("response").innerHTML = xhr.responseText; } }

"Nothing is returned" — How are you testing what is returned? — Quentin, Feb 24 '17 at 16:58
"echo the results back to the calling page" — Where is the code which should do that? — Quentin, Feb 24 '17 at 16:58
`mssql_query` & `mysql_error` — You can't get `mssql_` errors with the `mysql_` library. Don't mix your database libraries. — Quentin, Feb 24 '17 at 16:58
**Danger**: You are **vulnerable to [SQL injection attacks](http://bobby-tables.com/)** that you need to [defend](http://stackoverflow.com/questions/60174/best-way-to-prevent-sql-injection-in-php) yourself from. — Quentin, Feb 24 '17 at 16:59
@Quentin - good catch, I have updated but still no error presented — StarsFlyFree FromCozyNights, Feb 24 '17 at 17:01
@Quentin - how would I properly do this to avoid sql injection/ — StarsFlyFree FromCozyNights, Feb 24 '17 at 17:01

score 0 · Accepted Answer · answered Feb 24 '17 at 17:03

0

You are referring to the wrong global parameter. Your XHR call is specifying a "GET" request, but you are checking $_POST.

Try this: $state = $_GET['state'];

answered Feb 24 '17 at 17:03

AmericanUmlaut

2,817
2
17
27

That was it exactly! Thank you for pointing this out! – StarsFlyFree FromCozyNights Feb 24 '17 at 17:05

Vasiliki M. · Answer 2 · 2017-02-24T17:13:06.287

-1

First you shouldn't be using $_POST request, but $_GET.

Then, using echo won't return any result on javascript. It would be best to use json encoding for better protection.

print_r($result) //replace echo

Even if you want to show your data through php you should use print_r and not echo because your query result is an array and can't be read from just echo.

edited Feb 24 '17 at 17:13

answered Feb 24 '17 at 17:04

Vasiliki M.

372
3
12

echo will return results in javascript. I use it quite frequently – StarsFlyFree FromCozyNights Feb 24 '17 at 17:06

JavaScript To Pass Parameter To PHP And Run Query

2 Answers2