-1

i make a crud system with json file data. i used javascript to view data into a html file. but i think it cause some security issues. i want to make my data view using php not in JavaScript.

this is my JavaScript view file

var output = document.getElementById('output');

var ajaxhttp = new XMLHttpRequest();

var url = "form.json";

var xhttp = new XMLHttpRequest();
var details = '';
xhttp.onreadystatechange = function() {
    if (this.readyState == 4 && this.status == 200) {

        var response = JSON.parse(xhttp.responseText);

                var output = '';

                output += "<table class='table table-bordered'>";
                output += "<tr><th scope='col'>id</th><th>First Name</th><th>Last Name</th><th>Age</th><th>Action</th></tr>";              

                for(x in response){

                    if(response[x].is_active == "1"){


                    output += "<tr><td>" + response[x].id + "</td><td>" + response[x].firstname + "</td><td>"+response[x].lastname+"</td><td>"+response[x].age+"</td><td><a href='edit.php?id="+response[x].id+"&firstname="+response[x].firstname+"&lastname="+response[x].lastname+"&age="+response[x].age+"' class='btn btn-primary btn-sm active' role='button' aria-pressed='true'>Edit</a><a href='update.php?id="+response[x].id+"&firstname="+response[x].firstname+"&lastname="+response[x].lastname+"&age="+response[x].age+"' class='btn btn-danger btn-sm' role='button' data-toggle='modal' data-target='#exampleModal' name='btnDelete' style='margin-left: 10px;'>Delete</a></td></tr>";

                    }

                }

                output += "</table> ";
               document.getElementById("output").innerHTML = output;

    }
};
xhttp.open("GET", url, true);
xhttp.send();

i want to do this same thing using php. can anyone help me?

MJ DEV
  • 686
  • 1
  • 11
  • 31

1 Answers1

1

You can use PHP's curl functions to do the equivalent AJAX request from PHP.

You can use json_decode() to convert JSON into PHP objects and arrays.

Escape the output with htmlspecialchars().

If you want to fix your JS code, escape everything you got from the database on output. See Can I escape html special chars in javascript? or use jQuery's .text() function to populate the table.

gregjor
  • 21,802
  • 1
  • 23
  • 16