get id in url form ajax call php

Question

I need the id in url to make a mysql_query. The problem is that I need to make this from an Ajax call and $_GET['id'] apparently is not working. Is there an easy way to free myself from this? Thank you :)

Here is my ajax call:

echo "<div id='loading_utilizadores' class='loading'><img src='".$CONF['HOME']."/images/structure/ajax-loader.gif'/></div>";
        echo "<div id='utilizadores'></div>";

        echo "<script type='text/javascript'>";
            echo "CarregaAjax(\"#utilizadores\",\"#loading_utilizadores\",\"".$CONF['HOME']."/superadmin/box_utilizadores_ajax.php\", \"GET\")";
        echo "</script>";

The ajax function:

function CarregaAjax(id,loading,page,method){

if(method=="GET"){

    $(document).ready(function(){

        //$(loading).ajaxStart(function(){
            $(loading).show();
            $(id).hide();
        //});

        $(id).load(page);

        $(loading).ajaxStop(function(){
            $(loading).hide();
            $(id).show();
        });

    });

}
else{

    $(document).ready(function(){

        //$(method).submit(function() {
            $(loading).show();
            $(id).load(page,$(method).serializeArray());
            $(loading).hide();
            return false;
        //});

    });

}

And the peace of html ajax call. In this page I try to make the $_GET['id'], but with no success.

if (isset($_GET['id']))
{
    $officeID =  intval($_GET['id']);
}
else
{
    $officeID =  0;
}

if(!isset($crm_users))$crm_users = new crm_utilizadores;

//$officeID = 12;
$resultGetUsers = $crm_users->getUsersByOfficeId($officeID);

$html = "<table class='table1' width='100%' cellpadding='5' cellspacing='1' border='0'>";

if(!empty($resultGetUsers)){

    $html .= "<tr>";
        $html .= "<td class='table_title1'>Utilizador</td>";
        $html .= "<td class='table_title1'>Telefone</td>";
        $html .= "<td class='table_title1'>Telemóvel</td>";
        $html .= "<td class='table_title1'>E-mail</td>";
        $html .= "<td class='table_title1'>Situação</td>";
    $html .= "</tr>";
}else{
    $html .= "<tr><td class='empty1'>não foram encontrados utilizadores registados neste cliente</td></tr>";
}

//finalizar a tabela
$html .= "</table>";

I guess I'm mising the point, right? :p

Answer 1

This code attempts to read the id value from the URL:

$_GET['id']

But this is the URL you're requesting:

/superadmin/box_utilizadores_ajax.php

As you can see, there is no id value (or any other value). That would look something like this instead:

/superadmin/box_utilizadores_ajax.php?id=123

The value has to be on the URL in order for $_GET to read it.

---

Now, the page you're currently viewing may have that value in the URL you previously requested . But the server-side code isn't looking at your screen or interacting with your web browser. All it knows is the request that you send it. And that request doesn't contain that value.

You can, when loading the page, put that value on the request. In index.php read the $_GET['id'] value and output it to the JavaScript code which is making that AJAX request. Technically it could be something as simple as this, just to demonstrate:

"/superadmin/box_utilizadores_ajax.php?id=" . $_GET['id'] . "\", \"GET\")"

However , be aware of the dangers of outputting raw user input to the page. This results in things like XSS vulnerabilities . Be mindful of what you're outputting to the page, but ultimately you need to output that value somewhere in order for that JavaScript code to send it to the next (AJAX) request. (Or, alternatively, you could store the file server-side in session state or something similar. Thereby removing the URL from the equation entirely. There are pros and cons either way.)

---

In short, you need to include the value on the URL being requested if the page at that URL is going to read the value. The code can only read values which are there.