0

I want to send my variable from javascript to PHP using post method that needs to be used in SQL query, but my variable value has a special character like " / " that server doesn't perform it, it's my sample code:

js:

var my_var = "ok1 / ok2_4"; // its my table name in database

$.post(
        "part/order/order_from_js.php",
        {
        name: my_var,
        },
        function(data) {
        
        // using data .... 
        }

php:

<?php 
session_start();

$db=mysqli_connect("localhost","user_db","","db_name");
$name = mysqli_real_escape_string($db, $_POST['name']);// this is my main problem somehow

   $select_query = "SELECT * FROM $name";

$users_query = $db->query($select_query);
if ($users_query ->num_rows > 0) {
  
    $i=0;
    while($row = $users_query->fetch_assoc()) {
       $array[$i]= $row;

          $i=$i+1;
    }
}
mysqli_close($db);


echo json_encode($array);


  ?>

I have an error and nothing will pass back to javascript. I want to persist using mysqli_real_escape_string for avoid SQL injection attack.

Fernand
  • 50
  • 9
  • Your problem is `mysqli_real_escape_string`. This function _changes_ the value. Why do you need to pass a table name as a variable? That usually indicates poor database structure. – GrumpyCrouton Aug 12 '20 at 18:26
  • The real problem is the lack of prepared statements. – Taplar Aug 12 '20 at 18:27
  • @Taplar but a prepared statement wouldn't work here either. – GrumpyCrouton Aug 12 '20 at 18:28
  • 1
    And, why would you have a table called "ok1 / ok2_4", doesn't that just make every single operation more of a pain than it needs to be? Not helping, I know. – droopsnoot Aug 12 '20 at 18:30
  • @droopsnoot It's probably indicative of poor database structure. The database name is probably dynamically generated. – GrumpyCrouton Aug 12 '20 at 18:32
  • I guess what you could do is in javascript: `name: encodeURIComponent(my_var)` and `urldecode` it in PHP. Not as a security replacement but just rather to get the `/` passed. – imvain2 Aug 12 '20 at 18:33
  • Notice: Undefined index: name in D:\xampp\htdocs\.... line 5. its my error when i open my php tab and i have Null in return. i have not error in console by the way. i have many names like it in database and long scripts that is hard to change all. i will do it if i not found anything :) – Fernand Aug 12 '20 at 18:35
  • Your code is vulnerable to SQL injection. Please read over https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php for ways to fix this. – WOUNDEDStevenJones Aug 12 '20 at 18:41
  • You need to escape that table name `SELECT * FROM \`$name\`` as space and `/` aren't allowed without it. – AbraCadaver Aug 12 '20 at 18:53
  • "its my error when i open my php tab and i have Null in return"...what do you mean by "open my PHP tab" exactly? If you visit "order_from_js.php" directly in your browser window then of course you will see this error because that does a GET instead of a POST, and doesn't pass any variables. But it's when you run it via AJAX $.post that you need to be testing it - you can see what's happening there by using your browser's Developer Tools, in the Network tool and sometimes the Console too. – ADyson Aug 12 '20 at 18:56

0 Answers0