如何在Google Maps API中访问此变量？

Question

I have a google maps web application for a game where the user will click a google map marker, make a selection in the window that pops up and click submit. It uses AJAX to update the database with information selected by the user. The database is pre-populated with names of the markers and GPS coordinates, which are loaded. The markers are also placed accordingly upon load via XML.

I'm having trouble updating one row in my DB called quest with the user selected information when it's submitted. Currently, a user can select a marker and submit a quest, but it won't update the DB at all. I'm unsure on the correct WHERE statement to use. Here's my current SQL statement, I'm attempting to update a row called quest.

mysqli_query($con, "UPDATE markers SET quest= '$questName'  WHERE markerName = '$markerName'");

This is what happens when the submit button is pressed.

if (document.getElementById("questType").value == 
"quest1") { //if quest1 is selected upon submission
alert("quest1");
var markerName;
var questName = "Quest 1";
xmlhttp = new XMLHttpRequest();        
xmlhttp.open("GET", "ajax.php?questName=" + questName + "&markerName=" + markerName, true);         
xmlhttp.send(); //Sending the request to the server

ajax.php

<?php 
include("connect.php");
require("call2.php");
$markerName = mysqli_real_escape_string($con, $_GET['markerName']);
$questName = mysqli_real_escape_string($con, $_GET['questName']);


$stmt = $con->prepare("UPDATE markers SET quest = $questName WHERE markerName = $markerName");
$stmt->bind_param($questName, $markerName);
$stmt->execute();
$stmt->close();
?>

Here is my relevant call file as well.

$dom     = new DOMDocument("1.0");
$node    = $dom->createElement("markers");
$parnode = $dom->appendChild($node);
include('connect.php');
$query  = "SELECT * FROM markers WHERE 1"; // Select all the rows in the markers table
$result = mysqli_query($con, $query);
if (!$result) {
die('Invalid query: ' . mysqli_error($con));
}

// Iterate through the rows, adding XML nodes for each
while ($row = mysqli_fetch_assoc($result)) {
global $dom, $node, $parnode;

$node    = $dom->createElement("marker");
$newnode = $parnode->appendChild($node);
$newnode->setAttribute("markerName", 
$row['markerName']);
$newnode->setAttribute("quest", $row['quest']);
$newnode->setAttribute("lat", $row['lat']);
$newnode->setAttribute("longg", $row['longg']);
}

header("Content-type: text/xml");
echo $dom->saveXML();

Sorry if this is a lot, I think the problem is i'm not assigning a value to markerName . I don't get any errors, however when I hover over the ajaxphp in the network tab on chrome it looks like it's getting the questName but markerName remains undefined.

Here's where it's loading things in:

downloadUrl("call2.php", function(data) {
var xml = data.responseXML;
var markers = xml.documentElement.getElementsByTagName("marker");
for (var i = 0; i < markers.length; i++) {
var name = markers[i].getAttribute("markerName"); //<------ here's where it's getting markerName
//  var address = markers[i].getAttribute("address");
var type = markers[i].getAttribute("type");
var point = new google.maps.LatLng(
  parseFloat(markers[i].getAttribute("lat")),
  parseFloat(markers[i].getAttribute("longg")));
var icon = customLabel[type] || {};
var marker = new google.maps.Marker({
map: map,
position: point,
icon: icon.icon,
shadow: icon.shadow
  });
  bindInfoWindow(marker, map, infoWindow, html);
}
});

I think I need to figure out a way to access name, but I'm unsure how to when it's local to the function which downloads the XML file.

connect.php

<?php
$con = mysqli_connect("localhost", "root", "", "pokestop-map");
?>

Answer 1

First of all, I think in some cases your Database Connection Credentials could be leaked if your Database is down and somebody is requesting ajax.php. If you want to use code in an production environment you should never leak errors to the client. Also I'm not sure if you're trying to add the Params to your Query through PHP's ability to evaluate variables in Strings, if so that is very unsecure and I would recommend you to read about Prepared Statements. Also I would recommend you to use PDO's ( http://php.net/manual/de/book.pdo.php ) instead of MySQLi but that's just a sidenote. I think the Problem here is that you don't bind your value to the Query. It's a long time ago that i've used MySQLi but I think you could do something like:

$stmt = $mysqli->prepare("UPDATE markers SET quest = ? WHERE markerName = ?");
$stmt->bind_param($questName, $markerName);
$stmt->execute();
$stmt->close();

Edit: I would recommend you to look at ORM libraries which allow you to Map the Rows in a table to an object in PHP. There are a few of them out there like Doctrine or Idiorm . Working with Objects is much cleaner. But anyway I also wrote a little bit code which may help you, but I have to say its not tested.

DB.php (Holds an PDO in Singleton Pattern which will be used to communicate with the Database):

require_once('Config.php');

class DB {
    private static $_instance = null;
    private $_pdo;

    private function __construct() {
        try {
            $this->_pdo = new PDO('mysql:host=' . Config::getDbHost() . ';dbname=' . Config::getDbName(), Config::getDbUser(), Config::getDbPass());
        } catch(PDOException $e) {
            die($e->getMessage());
        }
    }

    public static function getInstance() {
        if(!isset(self::$_instance)) {
            self::$_instance = new DB();
        }
        return self::$_instance;
    }

    /**
     * @return PDO
     */
    public function getPdo()
    {
        return $this->_pdo;
    }
}

Config.php (Holds the settings needed to connect to the Database, you can extend the Class and parse some kind of configuration file to fill the values if you want):

class Config
{
    private static $_dbHost;
    private static $_dbName;
    private static $_dbUser;
    private static $_dbPass;

    /**
     * @return mixed
     */
    public static function getDbHost()
    {
        return self::$_dbHost;
    }

    /**
     * @return mixed
     */
    public static function getDbName()
    {
        return self::$_dbName;
    }

    /**
     * @return mixed
     */
    public static function getDbUser()
    {
        return self::$_dbUser;
    }

    /**
     * @return mixed
     */
    public static function getDbPass()
    {
        return self::$_dbPass;
    }
}

With these classes you should be able to do the following:

<?php
require_once('DB.php');

$pdo = DB::getInstance()->getPdo();
$stmt = $pdo->prepare('UPDATE markers SET quest = :questName WHERE markerName = :markerName');

$stmt->bindValue('questName', $_GET['questName']);
$stmt->bindValue('markerName', $_GET['markerName']);

$stmt->execute();

As I said this is not tested, but it should work. Maybe you have to fix includes and Parameter Binding...