通过AJAX进行SQL插入和删除查询

Question

I am trying send insert and delete sql queries using AJAX and PHP. I have checked the network tab of developer tools and I can see that when I click the input it successfully retrieves the values so the main issue I am having is inserting these values into the DB and deleting values from the DB.

EDIT: No error messages return in regards to my SQL query so I am unsure whats happening.

Here is my HTML and JQUERY code:

  $(document).ready(function() { $("#favbut").click(function() { var username = $("#usernamefav").val(); var lid = $("#lidfav").val(); var favourite = $("#favouritefav").val(); $.ajax({ url: "fave.php", type: "post", dataType: "json", data: { username: username, lid: lid, favourite: favourite } }); }); $("#unfavbut").click(function() { var username = $("#usernameunfav").val(); var lid = $("#lidunfav").val(); var favourite = $("#favouriteunfav").val(); $.ajax({ url: "unfave.php", type: "post", dataType: "json", data: { username: username, lid: lid, favourite: favourite } }); }); }); 

 <input type="hidden" name="username" id="usernamefav" value='.$user.'> <input type="hidden" name="lid" id="lidfav" value='.$lid.'> <input type="hidden" name="favourite" id="favouritefav" value=YES> <input class="favButt fav" id="favbut" type="submit" name="faveBTN" value="Fave">'; <input type="hidden" name="username" id="usernameunfav" value='.$user.'> <input type="hidden" name="lid" id="lidunfav" value='.$lid.'> <input type="hidden" name="favourite" id="favouriteunfav" value=YES> <input class="favButt unfav" id="unfavbut" type="submit" name="unfaveBTN" value="unFave">'; 

Here is the php files:

<?php
if(isset($_POST['favbut'])){
include 'includes/dbh.inc.php';

$username = $_POST['username'];
$lid = $_POST['lid'];
$favourite = $_POST['favourite'];

$sql = "INSERT INTO userslocation (fid,username,lid,favourite) VALUES ('','".$username."', '".$lid."','".$favourite."')";
$result = (mysqli_query($conn, $sql));          
}
?>

<?php

if(isset($_POST['unfavbut'])){
    include 'includes/dbh.inc.php';
$username = $_POST['username'];
$lid = $_POST['lid'];
$favourite = $_POST['favourite'];

$sql = "DELETE FROM userslocation WHERE username='$username' AND lid='$lid'";
$result = (mysqli_query($conn, $sql));          
}
?>

Any help as to what is going wrong is appreciated!

Answer 1

Actually your queries looks good. But @RonCajan said right about possible SQL Injection.

1) I think you have errors here:

if(isset($_POST['favbut'])) { ...
...
if(isset($_POST['unfavbut'])) { ...

You don't pass these values by your $.ajax requests. Add them to your request or instead of passing them you can check isset of lid value.

Easy way to check it is to make echo 1; before condition and echo 2; inside statement block. And watch response.

2) As @RonCajan said if your fid column is auto_increment you should skip it in your query, don't set it as '' .

Also in php if you use double quotes you don't need to use concatenation to insert variables values. docs

$query = "INSERT INTO userslocation (username, lid, favourite) VALUES ('${username}', '${lid}','${favourite}')";

And one more advice. Learn how to use debug tools as xdebug . It becomes much easier to find mistakes in your code.

Answer 2

Updated:

First of all your code is prone to SQL Injection. Use prepared statement for security purposes. Refer to this site to improve your code. http://php.net/manual/en/book.mysqli.php

I think you have mistaken this one.

$sql = "INSERT INTO userslocation 
(fid,username,lid,favourite) VALUES ('','".$username."', 
'".$lid."','".$favourite."')"; 

Instead use this query :

$sql = "INSERT INTO userslocation 
(username,lid,favourite) VALUES 
('$username','$lid','$favourite')"; 

If your fid has an auto_increment by default you dont need to join it on your query and dont concatenate your query. I think concatenating is for connecting two string or for printing the text.

In your html code. Try to use <?php echo $variable; ?> <?php echo $variable; ?> in all your input value. Maybe it does not contain any value.