0

I have a jqm app I'm working on. I am querying a mysql db to create links, they aren't working . I have read and learned that you cant use location.search in jq mobile, so I have added an attribute data-link in my .

I have a cookie set with the userid, when the user goes to look up recipes, it reads his cookie gets his userid then does a query for all the recipes with the corresponding userid, then displays them.

I would like to be able to click on one of the created links, go to a different page, then do a query with that link id and pull up the actual recipe.

Here is the js I am using to pull up the php file.

$(document).on("pageshow","#retrieve",function(){
var  uid1 = $.cookie('recuid');
var uid = uid1.substr(7);
var data;
    var response = '';
    $.ajax({ type: "GET",   
             url: "retrieve_recipes.php?userid=" + uid, 
             dataType: "html",   
             async: false,
             success : function(response)
             {
                 $("#show_recipe").html(response); 

           }   
    });
    });

Here is the php code used to create the link list.

<?php
include_once('../recipe_holder/connect.php');
$uid = $_GET['userid'];
$sql = "SELECT * FROM  recipes WHERE userid = '$uid'";
$result = mysqli_query($conn, $sql);
if (mysqli_num_rows($result) > 0) {
while($row = mysqli_fetch_assoc($result)) {
echo "<a href='#showRecipe' class='ui-btn' data-link='".$row['uid']."'>".$row['title']."</a> "; 
}
} else {}
?>

Here is the jquery/js code I am using to get the uid of the particular recipe to query the db and display the data. I have this simplified, simply with an alert to display the uid, I figure if I can get that much to work, I can get the rest to work.

$('[data-link]').click(function(){
var uid = $(this).attr('data-link');

 alert(uid);    

 });

any ideas would be much appreciated.

thanks.

Dave
  • 43
  • 8
  • Try $('.ui-btn') instead of $('[data-link]') – Kshitij Kumar Nov 25 '17 at 16:28
  • Your code is vulnerable to [**SQL injection**](https://en.wikipedia.org/wiki/SQL_injection) attacks. You should use prepared statements with bound parameters, via either the [**mysqli**](https://secure.php.net/manual/en/mysqli.prepare.php) or [**PDO**](https://secure.php.net/manual/en/pdo.prepared-statements.php) drivers. [**This post**](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) has some good examples. – Alex Howansky Nov 25 '17 at 16:37

0 Answers0