-1

I am quite new in the programming and I try to check if a shop has been already assigned to an user. if yes nobody can be assigned to this shop anymore.

so in the index file I make a call via $.ajax of searchunicusershop.php but it didn't seem to call it.

in index.php


    unic = {};
    data = "siret=" + $('#siret').val() + "&emllog=" + $('#email_login').text();
    $.ajax({
        type: 'GET',
        url: 'searchunicusershop.php',
        data: data,
        dataType: 'json',
        success: function(result, statut) {
            unic = {};
            unic = result;
            if (unic.response == false) {
                if (unic.status == 'alreadyassign') {
                      $('.messmenu').text('shop already assigned');
                    $('.profile-card-pro').scrollTop(0);
                }
            }
        },
        error: function(result, statut, erreur) {
            console.log(statut);
            console.log(erreur);
        },

        complete: function(result, statut, erreur) {
        }
    });

the searchunicusrshop.php

<?php
header("Content-Type: application/json ; charset=utf-8");
header("Cache-Control: no-cache , private");
header("Pragma: no-cache");

$email_login = ' ';
$siret = ' ';
$siren = ' ';
$nic = ' ';

$res1 = ' ';
$res2 = ' ';
$res3 = ' ';

$tunic=[];
$tunic['emllog'] = ' ';
$tunic['siret'] = ' ';
$tunic['status'] = 'false';
$tunic['shopid'] = ' ';
$tunic['admid'] = ' ';
$tunic['emladm'] = ' ';
$tunic['response'] = false;

$shopshop_id = ' ';
$hasshopuser_id = ' ';
$usersuser_email = ' ';
var_dump ($_GET);
require_once('connexionMysqlCheck.php');  
if ($connected) {    
    require_once('connexionMysql.php');
    if (isset($_GET['siret']) && isset($_GET['emllog'])) { 

        $email_login = $_GET['emllog']; 
        $tunic['emllog'] = $email_login;
        $tunic['siret'] = $_GET['$siret'];
        $tunic['status'] = 'paramfull';

        $siret = $_GET['siret'];
        $siren = substr($siret, 0, 9);
        $nic = intval(substr($siret, 9, 5));

        // Recherche du shop_id avec siret pour accéder ) user_has_shop         
        $query1="SELECT shop_id FROM shop WHERE siren = ".$siren." and nic = ".$nic."";
        var_dump ($query1);
        $res1=mysqli_query($connexion,$query1) or die('Erreur SQL !<br />'.$query1.'<br />'.mysqlerror());
        if (mysqli_num_rows($res1)>0)  {    // si le shop est trouvé      

            while ( $enreg=mysqli_fetch_array($res1) ) {  // récupérer le shop_id                    
                $shopshop_id = $enreg['shop_id'];
                $tunic['shopid'] = $enreg['shop_id'];
                $tunic['status'] = 'shopfound';       
                mysql_free_result ($res1);

                // si shop_id trouvé alors recherche du user_id avec le shop_id dans la table user_has_shop     
                $query2="SELECT user_id FROM user_has_shop WHERE shop_id = ".$shopshop_id." and shop_admin = 1";
                echo $query2;
                $res2=mysqli_query($connexion,$query2) or die('Erreur SQL !<br />'.$query2.'<br />'.mysqlerror());
                if (mysqli_num_rows($res2)>0)  {    // s'il y a une association qui existe pour ce shop
                    while ( $enreg=mysqli_fetch_array($res2) ) {  // récupérer le user_id qui est associé dans users has shop
                        $hasshopuser_id = $enreg['user_id'];
                        $tunic['admid'] = $hasshopuser_id;
                        $tunic['status'] = 'assocfound';  
                        mysql_free_result ($res2);

                        // Recherche si l'utilisateur via son email existe dans users  
                        $query3="SELECT email_login FROM users WHERE user_id = '".$hasshopuser_id"'";
                        echo $query3;
                        $res3=mysqli_query($connexion,$query3) or die('Erreur SQL !<br />'.$query3.'<br />'.mysqlerror());
                        if (mysqli_num_rows($res3)>0)  {    // si l'utilisateur est trouvé    
                            while ( $enreg=mysqli_fetch_array($res3) ) {  // récupérer le user_id de users                    
                                $usersuser_email = $enreg['email_login'];
                                $tunic['emladm'] = $useruser_email;
                                $tunic['status'] = 'admassocfound';  
                                mysql_free_result ($res3);


                                if ($email_login == $useruser_email) { // si le shop est déjà associé à lui alors ok
                                    $tunic['status'] = 'assochimself';
                                    $tunic['responses'] = true;
                                } else { //si il y a déjà une association mais à quelqu'un d'autre alors il ne peut pas
                                    $tunic['status'] = 'alreadyassign';
                                    $tunic['response'] = false;
                                } 

                            } // fin de while pour récupérer lemail du user associé dans users  query3 ***********************

                        } else {
                            $tunic['admid'] = $hasshopuser_id;
                            $tunic['emladm'] = ' ';
                            $tunic['status'] = 'admnotfoundcritical';
                            $tunic['response'] = false;

                        } // si l'utilisateur adm n'est pas trouvé user, c'est pas normal

                    } // fin de while pour récupérer le user_id de user_has_shop  query2 ***********************       

                } else { // si pas assoc alors c'est bon
                    $tunic['admid'] = ' ';
                    $tunic['emladm'] = ' ';
                    $tunic['status'] = 'noassocfound';
                    $tunic['response'] = true;
                } // si pas d'association alors c'est bon

            } // fin while récupérer shop_id query1 uy**************************************
        } else { // si le shop_id n'est pas trouvé dans shop ne rien faire c'est false  
            $tunic['status'] = 'siretnotfound';
            $tunic['shopid'] = ' ';
            $tunic['admid'] = ' ';
            $tunic['emladm'] = ' ';
            $tunic['response'] = false;

        }// si le shop_id n'est pas trouvé dans shop ne rien faire c'est false   

    } else { // ne trouve pas not isset. l'un des 2 ou les 2 paramètres email et/ou siret est vide (sont vides)
        $tunic['emllog'] = $_GET['emllog'];
        $tunic['siret']  = $_GET['siret'];
        $tunic['status'] = 'paramempty';
        $tunic['shopid'] = ' ';
        $tunic['admid'] = ' ';
        $tunic['emladm'] = ' ';
        $tunic['response'] = false; 

    } // fin not isset
} // connecté
$result = $tunic;
echo json_encode($result);
?>             

I don't know if the index call it or not, if it was successful or in error. I try to debug via chrome but it went through this code but I didn't get any ajax status or result.

Thank you in advance for your help.

RiggsFolly
  • 93,638
  • 21
  • 103
  • 149
  • Look at your logs in webdeveloper and on the server. – symcbean Apr 20 '21 at 17:02
  • Remove the `var_dump ($_GET);` it will be the first thing sent back to the `success` method of your AJAX Call and it is not JSON so it will get everything all Bitter and Twisted – RiggsFolly Apr 20 '21 at 17:18
  • To determine if the AJAX request ran, open the Developer toolbar and choose the Network tab. When you trigger the action, the request should appear there. If it doesn't, then inspect the code that's supposed to trigger it. If it does, it's time to debug the PHP response. – El_Vanja Apr 20 '21 at 17:22
  • **Warning:** You are wide open to [SQL Injections](https://php.net/manual/en/security.database.sql-injection.php) and should use parameterized **prepared statements** instead of manually building your queries. They are provided by [PDO](https://php.net/manual/pdo.prepared-statements.php) or by [MySQLi](https://php.net/manual/mysqli.quickstart.prepared-statements.php). Never trust any kind of input! Even when your queries are executed only by trusted users, [you are still in risk of corrupting your data](http://bobby-tables.com/). [Escaping is not enough!](https://stackoverflow.com/q/5741187) – Dharman Apr 20 '21 at 17:56
  • I look at the network tab and I can see the request searchunicusrshop.php but the status is 500. the input parameters seem good. – user15708319 Apr 21 '21 at 10:20

1 Answers1

0

I found where the issue is :

$query3="SELECT email_login FROM users WHERE user_id = '".$hasshopuser_id"'";

it should be this instead :

$query3="SELECT email_login FROM users WHERE user_id = ".$hasshopuser_id;