0

I am trying to send data from my ionic app to mysql. The problem is when I click on the submit button, it actually post empty records in the database.

My HTML code

<form >
  <label class="item item-input">
    <span class="input-label">Product Name:</span>
    <input type="text" ng-model="productname">
  </label>
  <label class="item item-input">
    <span class="input-label">Product Price:</span>
    <input type="number" ng-model="productprice" >
  </label>
  <label class="item item-input">
    <span class="input-label" >Description:</span>
    <input type="text" ng-model="productdescription">
  </label>
  <input type="button" value="Submit" class="button button-assertive button-block" ng-click="submit()">
</form>

The controller for the project

App.controller('appCtrl',  ['$scope', '$http', '$state, function ($scope, 
$http, $state, $ionicPopup, $timeout) {
  $scope.submit = function (){
    var link = "http://localhost/api.php";
    $http.post(link, {
       'productname' : $scope.productname,
        'productprice' : $scope.productprice,
        'productdescription' : $scopeproduct.description,
      }).success(function(response){

        $scope.pdata= response;
        console.log(response);

        //console.log(response);
      })
    }
   }]);

This is my PHP code to post the the data to database

<?php  

    header("Access-Control-Allow-Origin: *");
    header("Content-Type: application/json; charset=UTF-8");

    $conn = new mysqli("localhost", "root", "", "ionic");

    if ($conn->connect_error) {
        die("Connection failed: " .$conn->connect_error);
    } 

    $postdata = file_get_contents("php://input");

    if(isset($postdata) && !empty($postdata))
    {
    $request = json_decode($postdata);


    $pname = $request->productname;
    $pprice = $request->productprice;
    $pdescription = $request->productdescription;


     $sql = ("INSERT INTO `users` ( product_name, product_price, description) VALUES ('$pname', '$pprice', '$pdescription')");

      mysqli_query($conn, $sql);
  }

?

Isaac Afful
  • 1
  • 1
  • Notice anything missing right here `'$http', '$state, funct`? – Jay Blanchard Apr 13 '17 at 20:07
  • [Little Bobby](http://bobby-tables.com/) says ***[your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php)*** Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php). Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! – Jay Blanchard Apr 13 '17 at 20:07
  • Did you var_dump($request) on your api.php ? What is content of it? – Оzgur Apr 13 '17 at 20:07

0 Answers0