Ajax response from Zend frameword

Question

Recently, I've been trying to create an online CRM using jquery/php/xml-rpc and I've had an issue that I just can't seem to find the solution to.

I currently have an ajax request sending an element id to a php document that when opened on its own (as a direct url to the document) returns a response from the API server (either a Boolean or some error like 'wrong data').

However this doesn't come out to my page at all and I am not sure the data I am sending is even getting through to the php document.

This is my jquery code:

$('#SomeElement').on('click', function(){
    var id = $('#ELEMENTID').attr('value');

    $.ajax ({
        type:'POST',
        url: 'PHPfile.php',
        dataType: 'json',
        data: {id:id},
        success: function(data) {
            if(data.indexOf('YES') === -1){
                $('.alert-success').show();
                $('.alert-success').html(data);

                /*setTimeout(function() {
                    $('.alert-success').fadeOut('slow');
                    location.reload();
                }, 2000);*/
            } else {
                $('.alert-danger').show();
                $('.alert-danger').html(data);

                /*setTimeout(function() {
                    $('.alert-danger').fadeOut('slow');
                    location.reload();
                }, 2000);*/
            }
        }
    });
});

And this is my PHP code:

require 'init_autoloader.php';

Zend\Mvc\Application::init(require 'config/application.config.php')->run();

$q = mysqli_query($conn, "SELECT * FROM some db WHERE somekey = '$_POST[id]'");

$main = mysqli_fetch_assoc($q);

if($main['someentry'] !== '0') {

    echo 'This is FALSE';

} else {

    $r = mysqli_query($conn, "SELECT * FROM side_db WHERE side_id = '$_POST[id]'");
    $p = mysqli_query($conn, "SELECT * FROM ext_db WHERE ext_id = '$_POST[id]'");
    $m = mysqli_query($conn, "SELECT * FROM img_db WHERE img_id = '$_POST[id]'");


    $side = mysqli_fetch_assoc($r);
    $ext = mysqli_fetch_assoc($p);

    if((int)$ext['gt'] === '0' || (int)$ext['gt'] === '1') {
        $g = 'yes';
    } else {
        $g = 'no';
    }

    foreach($ext as $key => $value) {
        if($key === 'somestring') {
            continue;
        }else if($value === '0' || $value === '1') {
            $ext[$key] = 'no';
        } else if($value === '2'){
            $ext[$key] = 'yes';
        }
    }

    foreach($main as $k => $v) {
        if($v === '0' || $v === '1') {
            $main[$k] = 'no';
        } else if($v === '2'){
            $main[$k] = 'yes';
        }
    }

    require 'init_autoloader.php';

    Zend\Mvc\Application::init(require 'config/application.config.php')->run();

    $appkey = 'appkey';
    $someid = id;
    $something = 'something';
    $else = 'else';

    $divarray = Array
    (
        'HEAL' = Array(
            [0] = "WARLOCK",
            [1] = "PRIEST",
            [2] = "ROGUE",
            [3] = "WARRIOR",
            [4] = "MAGE"
        ),
        "someENTRY" = 'YES'
    );
    $oxClient = new \Zend\XmlRpc\Client('http://link-to-server.php');

    $somenewrequest = $oxClient->call('class.OfAPI',array($appkey,$someid,$something,$else,$divarray));

    $res = $oxClient->getLastResponse();

    echo $res;

    $client = new \Zend\XmlRpc\Client('http://link-to-server.php');

    if($m !== FALSE) {
        $j = 1;

        while($img = mysqli_fetch_assoc($m)) {
            $pather = str_replace('../',"",$img['img_path']);
            $url = str_replace('www.', "", $_SERVER['HTTP_HOST']);

            $imagedata = file_get_contents('OUR/FILE/PATH/OF/SERVER'.$url.'/'.$pather);

            $base64 = base64_encode($imagedata);

            $SOMEID = $res;
            $image = $base64;

            $client->call('CLASS.IMAGESOMETHING',array($appkey,$usr,$psw,$res,$image));

            $j++;
        }
    }

    $fin = mysqli_query($conn, "UPDATE our_db SET avalue = '1' WHERE somefield = '$_POST[id]'");

    echo 'You succeeded in doing w/e';

}

Excluding all the small errors I might have done due to having to rewrite half of the code to protect sensitive information, I want to know what I can change so that I can see the responses pop up on the page where the ajax is run.

I tried JSON.encode on the $res but that didn't seem to solve anything. Is there something I am missing or something I can do differently to get the responses I need or even see if the ajax variable is getting through to the php document.

Either way I would be happy to know what I am doing wrong so I can improve and not have to run into the problem in the future.

Thanks in advance!

Your code is vulnerable to [**SQL injection**](https://en.wikipedia.org/wiki/SQL_injection) attacks. You should use [**mysqli**](https://secure.php.net/manual/en/mysqli.prepare.php) or [**PDO**](https://secure.php.net/manual/en/pdo.prepared-statements.php) prepared statements with bound parameters as described in [**this post**](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php). — Alex Howansky, May 30 '17 at 18:49

score 0 · Answer 1 · answered May 30 '17 at 19:29

In your $.(ajax) please put id in quotes to make sure it is interpreted as field name:

data: {'id':id},

Use developer-tools of google chrome to inspect your POST-request going to the server. Here a very good intro:

https://blog.versionone.com/spy-on-browser-http-requests/

Ajax response from Zend frameword

1 Answers1