How to send data from browser to server and reply back

Question

On my webpage I have a textarea where the user inputs all kind of characters.
When he saves it I want to send the data using AJAX to the server for storing in the database. After this, the server will send back the data to the browser to be displayed.

Which is the right way to do this?
Right now I make an AJAX call:

function update()
{
    $.ajax({
        type: "POST",
        url: "ajax/update.php",
        data: "ID=" + ID + "&value=" + encodeURIComponent($('#newText').val()),
        success: function(html) {
            $('#l' + CurrentID).html(decodeURIComponent(html));
        }
    });
}

and my php file looks like this:

<?php

$ID = $_POST["ID"];
$value = nl2br(urldecode($_POST["value"]));
if (get_magic_quotes_gpc()) {
    $value = stripslashes($value);
}
$value = htmlentities($value);

$value = str_replace("<br />", "", $value);
$value = str_replace("<br/>", "", $value);
$value = str_replace("<br>", "", $value);

mysql_query("update MyTable set value = '$value' where id = $ID");

echo html_entity_decode(urlencode($value));
?>

I am not sure I am doing the things right. For sure I can see now the problem with spaces being replaced by + sign. But I am thinking that there is something I am not doing it by the book.

score 2 · Accepted Answer · edited May 23 '17 at 12:06

2

You could improve your AJAX call like this:

$.ajax({
    type: "POST",
    url: "ajax/update.php",
    data: { ID: ID, value: $('#newText').val() },
    success: function(html) {
        $('#l' + CurrentID).html(html);
    }
});

Notice how the data is sent using an object. You no longer need to worry about properly url encoding. jQuery takes care of it.

Also your PHP seems to be vulnerable to SQL injection. You should use prepared statements to avoid this.

edited May 23 '17 at 12:06

Community

1
1

answered Sep 18 '11 at 07:19

Darin Dimitrov

1,023,142
271
3,287
2,928

And for the php part? Is it ok how it is now? – Cristian Calu Sep 18 '11 at 07:20
I dont know why people try to build up the query string themselves.. you see so many SO questions like these.. – Baz1nga Sep 18 '11 at 07:21
@Cristian Calu, your PHP part seems vulnerable to SQL injection. I am not an expert in PHP but looking at those $value and $ID in the SQL query I am afraid this would be the case. – Darin Dimitrov Sep 18 '11 at 07:22

How to send data from browser to server and reply back

1 Answers1