Ajax call outputs the same message

Question

I have below ajax call that checks if a card_number exists in the customers' table or not, however, on both cases, I get the same response that it does not exist even if the card number exists. So both final messages will be "does not exist"

agent_reload.php

<script type="text/javascript">
    $(document).ready(function()
    {
        $("#card_number").change(function() 
        { 
            var card_num = $("#card_number").val();

            $.ajax({  
                type: "POST",  
                url: 'CheckUserCardNumber.php',  
                data: "card_number="+card_number,  
                success: function(msg){            
                    var Result = $.trim(msg);

                    if(Result === "does_not_exists")
                    { 
                        alert("does not exist");
                    }  
                    else  
                    {  
                        alert("exists");
                    }  
                } 
            }); 

            return false;
        });
    });
</script>

CheckCardNumber.php

<?php
include('dbconnection.php');
if(isset($_POST['card_number']))
{
    $Card_Number = $_POST['card_number'];
    $sql = "select * from customers where card_id='$Card_Number'";
    $Result = $db->query($sql);

    if ($Result->num_rows != 0)
    {
        echo "exists";
    }
    else
    {
        echo "does_not_exists";
    }
}

Have you watched the request/response in the browser's developer tools? — Jay Blanchard, Sep 18 '19 at 11:30
Also, you take a string from userinput and use it directly into your SQL. Highly dangerous (OK for testing, but don't ship like this). SQL injection — Erwin Moller, Sep 18 '19 at 11:35
you have to make sure that ajax request had success result first it seems like the success function not handled correctly, and please its more better to change Result to result. — bik, Sep 18 '19 at 11:41
@BilelKabtni - _"and please its more better to change Result to result."_ - Why would that be "better"? It's just a matter of preference and code style. — M. Eriksson, Sep 18 '19 at 11:50
@BilelKabtni - No. It's a matter of personal preference. It completely depends on what code style you're following. — M. Eriksson, Sep 18 '19 at 12:03

score 1 · Answer 1 · answered Sep 18 '19 at 11:41

1

Looks like you set the var to card_num but pass card_number to ajax:

var card_num = $("#card_number").val();
.
.
.
data: "card_number="+card_number,

answered Sep 18 '19 at 11:41

Rob Moll

3,345
2
9
15

Thank you so much, guys, it looks like it was a silly mistake, i had passed a wrong variable like mentioned by @Rob Moll. I have also fixed the SQL Injection. prepare("select * from customers where card_id=? "); $stmt->bind_param("s", $Card_Number); $stmt->execute(); $Result = $stmt->get_result(); if ($Result->num_rows != 0) { echo "exists"; } else { echo "does_not_exists"; } } – Bayar Shahab Sep 21 '19 at 14:15

score 1 · Answer 2 · edited Jun 20 '20 at 09:12

1

A tip

A good programming practise would be to use camelcase naming and proper indenting.

// <!-- CheckCardNumber.php --> 
<?php
if (isset($_POST['card_number'])) {

  include('dbconnection.php');

  $cardNumber = $_POST['card_number'];
  $sql        = "SELECT * from customers where card_id= '$cardNumber'";
  $result     = $db->query($sql);

  echo $result->num_rows > 0 ? 'Exists' : 'Does not exist.';
}

Solution

In your ajax request, you can just alert whatever response you got from if you set a proper message.

Also, make sure the value you send with your request is correct.

            $.ajax({  
                type: "POST",  
                url: 'CheckUserCardNumber.php',  
                data: "card_number="+$(this).val(),  
                success: function(msg){            
                   alert(msg); 
                } 
            });

Additionally, please always use PDO/Prepared MySQLI. How can prepared statements protect from SQL injection attacks?

edited Jun 20 '20 at 09:12

Community

1
1

answered Sep 18 '19 at 11:47

Thrallix

699
5
20

_"A good programming practise would be to use camelcase naming"_ - I wouldn't call that _"a good programming practice"_ but rather a personal preference. – M. Eriksson Sep 18 '19 at 11:53
It is considered a good practise because it avoids confusion and adds consistency. I didn't say it was the best practise, but it is a good one. – Thrallix Sep 18 '19 at 11:55
A good practice would to be consistent, that I agree with. But if you consistently use snake case, camel case or any other casing doesn't really matter. – M. Eriksson Sep 18 '19 at 11:55
I merely suggested one of several good practises that said poster can look into, do we really have to have an argument about how i named a matter that clearly would help the poster? – Thrallix Sep 18 '19 at 11:59

Ajax call outputs the same message

2 Answers2

A tip

Solution