PHP AJAX MySQL DELETE无法正常工作

Question

I am using Javascript (not JQuery) for this. I am attempting to delete records from a MySQL database that are selected using check boxes. The deletes do not happen using AJAX. However, it I call the PHP AJAX deletion script manually with the same parameters the delete works fine. However, when I run the AJAX PHP manually my Firefox browser reports a COR even though everything is on the same server and same domain.

Here is the HTML, Javascript and AJAX PHP deletion script:

This html is within an iframe if it matters:

<form name='frmDelFiles' method='POST' class='frmFileUpload' onClick='delChkdFiles("files2del")'>
<input type='submit' value='Delete Checked Files' name='delFiles' class='btnSubmit' />
</form>

Javascript:

function delChkdFiles(theCBgrp) {
    var where_stmt = "";
    var names      = "";
    var elements = document.getElementsByName(theCBgrp);

   for (var i = 0, l = elements.length; i < l; i++)
   {
      if (elements[i].checked)
      {
        var response = confirm("Do you consent to delete the " + elements[i].value + " file?\n\nClick OK if Yes, otherwise Cancel.");
        if (response == true) {
            if (where_stmt == "") {
                where_stmt  = "id=" + elements[i].id;
                names       = elements[i].value;
            } else {
                   where_stmt += " OR id=" + elements[i].id;
                   names      += ", " + elements[i].value;
                }
        }
    }
    }

    if (where_stmt == "") {
        alert("Zero files have been selected for deletion.");
    } else {
        xmlhttp=getHTTPObject();
       if (xmlhttp==null) {
            alert ("Your browser does not support AJAX!");
            return;
       }

        var url="/php/del_mysql_rcd.php";
        url=url+"?table=ip_attachments";
        url=url+"&where_stmt="+where_stmt;
        url=url+"&names="+names;
        url=url+"&sid="+Math.random();

        xmlhttp.open("GET",url,true);
        xmlhttp.onreadystatechange = handleShowResponse;
        xmlhttp.send(null);
    }
}

function handleShowResponse() {
   if (xmlhttp.readyState==4) {
      var ajaxStr = xmlhttp.responseText;
      alert(ajaxStr);
   }
}

del_mysql_rcd.php AJAX PHP:

<?php
$table      = $_GET["table"];
$where_stmt = $_GET["where_stmt"];
$names      = $_GET["names"];

require_once ('../php/mysql_connect.php'); // Connect to the db.

$query = "DELETE FROM $table WHERE $where_stmt";
$result = @mysql_query ($query) or die(mysql_error()); // Run the query.

if (mysql_affected_rows() > 0) {
    echo "Successfully deleted $names\n";
} else {
    echo "Failed to delete $names\n";
}
?>

Answer 1

The Firebug console shows the AJAX call in red.

firebug shows ajax calls in red when there's an interval server error

This html is within an iframe if it matters:

However, when I run the AJAX PHP manually my Firefox browser reports a COR even though everything is on the same server and same domain.

require_once ('../php/mysql_connect.php'); 

I'd say there's a path error, generating an interval server error when you try to require mysql_connect.php which will not happen when called directly from the browser, eg the iFrame might be messing with the original path.

In fact, it might not even get there if the iFrame messes up with you call

As for the sql injection problem, learn about mysqli or PDO. I really like the object oriented way of pdo, here's a tutorial for mysql developpers