Adding in a PHP email to a file that has info sent with an AJAX call killing code

Question

I created code that updates the user's group level(permission level). I send the selected id and group level via AJAX to a php file called user_update_group. Updating the user's group # worked perfectly before I tried to add the PHP email in the same file. I'm doing this because I am already getting that user's info from my database, so I thought it was the best approach.

However, when adding in the email it breaks the code. Is there something in my php file that is obviously killing this or can I not do it this way? I am trying to SELECT all the data in my users table from the id that was brought over and then send an email out to them using the same button as the other query used. My php email is the second part in the php file I added in here. I added in all of this code to show what I am trying to do.

<?php
$con2 = mysqli_connect("localhost", "root", "", "db");
$run2 = mysqli_query($con2,"SELECT * FROM user_requests ORDER BY id DESC");
$runUsers2 = mysqli_query($con2,"SELECT * FROM users ORDER BY id DESC");
$numrows2 = mysqli_num_rows($run2);

    if( $numrows2 ) {
        while($row2 = mysqli_fetch_assoc($run2)){
            if($row2['status'] == "Approved"){
            //var_dump ($row2);

                $approved_id        = $row2['user_id'];
                $approved_firstname = $row2['firstname'];
                $approved_lastname  = $row2['lastname'];
                $approved_username  = $row2['username'];

    if ($approved_firstname == true) {
        echo "Name - ". $approved_firstname . " " . $approved_lastname . "

</br>" . 
                "Username - ". $approved_username . "</br></br>"
?>
<div class="change_group_button"> 
     <a class="change_group" href="javascript:void(0)">Change User Permission</a>
</div><br>
<div id="light" class="change_group_popup">
    <a class="close" href="javascript:void(0)">Close</a>
 <div class="group_success" style="color: red;"></div><br>
    <form id="update_group" action="" method="POST" accept-charset="utf-8">
       <div class="field">
        <label for="group">Group</label>
        <input type="hidden" value="<?php echo $approved_id; ?>" id="approved_id" name="id" />
        <select id='group_id' name='group' required>
            <option value=''><?php echo htmlentities($group); ?></option>
            <option value="1">Bench</option>
            <option value="2">Spectator</option>
            <option value="3">Team Member</option>
            <option value="4">Commissioner</option>
        </select>
    </div>
    <input type="submit" value="submit" name="group">
    </form>

AJAX call

$(document).ready(function () {

    $('#update_group').on('submit', function (event) {
    event.preventDefault();
        $.ajax({
            url: 'user_group_update.php',
            type: 'POST',
            data: {
            id: $("#approved_id").val(), //id
           // update_group: $("#group_id").val() //group level
          update_group: $(this).find( "#group_id option:selected" ).val()
        },
            success: function (data) {
                //do something with the data that got returned
                $(".group_success").fadeIn();
                $(".group_success").show();
                $('.group_success').html('User Permission Level Changed!');
                $('.group_success').delay(5000).fadeOut(400);
               // alert(data);
            },
             error: function(jqXHR, textStatus,errorThrown )
            {
              // alert on an http error 
              alert( textStatus +  errorThrown );
            }
        });
        return false;
    });
});

user_group_update php file.

$approved_id = $_POST['id'];
$change_group = $_POST['update_group'];

$con = mysqli_connect("localhost","root","","db");
    /* check connection */
    if (mysqli_connect_errno()) {
        printf("Connect failed: %s\n", mysqli_connect_error());
        exit();
    }
    $stmt = $con->prepare("UPDATE users SET `group`=? WHERE id=?");
    if ( !$stmt || $con->error ) {
     // Check Errors for prepare
        die('User Group update prepare() failed: ' . htmlspecialchars($con->error));
    }
    if(!$stmt->bind_param('ii', $change_group, $approved_id)) {
    // Check errors for binding parameters
        die('User Group update bind_param() failed: ' . htmlspecialchars($stmt->error));
    }
    if(!$stmt->execute()) {
        die('User Group update execute() failed: ' . htmlspecialchars($stmt->error));
    }

    //-------Email test--------------

    $email_stmt = $con->prepare("SELECT * FROM users WHERE id=?");
    if ( !$email_stmt || $con->error ) {
     // Check Errors for prepare
        die('User email prepare() failed: ' . htmlspecialchars($con->error));
    }/*
    if(!$email_stmt->bind_param('ii', $change_group, $approved_id)) {
    // Check errors for binding parameters
        die('User email bind_param() failed: ' . htmlspecialchars($stmt->error));
    }
    if(!$email_stmt->execute()) {
        die('User email execute() failed: ' . htmlspecialchars($stmt->error));*/
        /*$pending_id = $_POST['id'];
        $group_firstname = $_POST['firstname'];
            $group_lastname = $_POST['lastname'];
            $group_username = $_POST['username'];
            $group_email = $_POST['email'];
            $group_email = $_POST['group'];

            $to = $group_email;
            $subject = 'There is a new user request to join the Sunday Funday League';
            $message = '
            <html>
            <head>
                <title>New SFL User Request</title>
            </head>
            <body>
                <p>Hi '.$group_firstname.',</p><br>
                <p>Your Sunday Funday League Account has been accepted. You have been added to the group. To sign in, click this link
                http://sundayfundayleague.com . </p><br>
                <p>Thank you,</p>
                <p>Administration</p>
            </body>
            </html>
            ';

            $from = "user-requests@sundayfundayleague.com";
            $Bcc = "user-requests-confirm@sundayfundayleague.com";

            // To send HTML mail, the Content-type header must be set
            $headers  = 'MIME-Version: 1.0' . "\r\n";
            $headers .= 'Content-type: text/html; charset=iso-8859-1' . "\r\n";

            // Additional headers
            $headers .= 'To: ' .$to. "\r\n";
            $headers .= 'From: ' .$from. "\r\n";
            $headers .= 'Bcc: '.$Bcc. "\r\n";

            // Send the email
            mail($to,$subject,$message,$headers);
    }*/

UPDATE code for user_update_group file

$approved_id = $_POST['id'];
//test - delete if it doesn't work
$approved_firstname = $_POST['firstname'];
$approved_lastname = $_POST['lastname'];
$approved_username = $_POST['username'];
$approved_email = $_POST['email'];
$change_group = $_POST['update_group'];


$con = mysqli_connect("localhost","root","","db");
    /* check connection */
    if (mysqli_connect_errno()) {
        printf("Connect failed: %s\n", mysqli_connect_error());
        exit();
    }
    $stmt = $con->prepare("UPDATE users,user_requests SET users.group=?, user_requests.group=? WHERE users.id=? AND user_requests.user_id=?");
    if ( !$stmt || $con->error ) {
     // Check Errors for prepare
        die('User Group update prepare() failed: ' . htmlspecialchars($con->error));
    }
    if(!$stmt->bind_param('iiii', $change_group, $change_group, $approved_id, $approved_id)) {
    // Check errors for binding parameters
        die('User Group update bind_param() failed: ' . htmlspecialchars($stmt->error));
    }
    if(!$stmt->execute()) {
        die('User Group update execute() failed: ' . htmlspecialchars($stmt->error));
    }

    //test
    $email_stmt = $con->prepare("SELECT * FROM users WHERE id=?");
    if ( !$email_stmt || $con->error ) {
     // Check Errors for prepare
        die('User email prepare() failed: ' . htmlspecialchars($con->error));
    }
    /*if(!$email_stmt->bind_param('ii', $change_group, $approved_id)) {
    // Check errors for binding parameters
        die('User email bind_param() failed: ' . htmlspecialchars($stmt->error));
    }
    if(!$email_stmt->execute()) {
        die('User email execute() failed: ' . htmlspecialchars($stmt->error));*/

            $to = $approved_email;
            $subject = 'There is a new user request to join t';
            $message = '
            <html>
            <head>
                <title>New User Request</title>
            </head>
            <body>
                <p>Hi '.$approved_firstname.',</p><br>
                <p>Your  Account has been accepted. You have been added to the group. To sign in, click this link
                http://example.com . </p><br>
                <p>Thank you,</p>
                <p>Administration</p>
            </body>
            </html>
            ';

            $from = "user-requests@example.com";
            $Bcc = "user-requests-confirm@example.com";

            // To send HTML mail, the Content-type header must be set
            $headers  = 'MIME-Version: 1.0' . "\r\n";
            $headers .= 'Content-type: text/html; charset=iso-8859-1' . "\r\n";

            // Additional headers
            $headers .= 'To: ' .$to;//. "\r\n";
            $headers .= 'From: ' .$from;//. "\r\n";
            $headers .= 'Bcc: '.$Bcc;//. "\r\n";

            // Send the email
            mail($to,$subject,$message,$headers);

Answer 1

_POST is auto generated by the browser on submit of the form. If you want to pass data through the post you have to use form submit fields. These fields can be hidden:

<input type=hidden name="lastname" value="{some_last_name}"/>