selection the value of an option on a dropdown list

Question

i'm working on this site that allows to students to book seats for training sessions by selectiong theme on a drop down list and clincking on a button. i created a javascript(ajax) script that contains a function which calls a php script that reduces the number of seats on my database. But unfortunately it's not working... i need your help guys : here's my javascript :

<select name="Branche" name="clock" id="clock" onchange="count()"></select>
<a  onclick="count()" class="button">
    <span class="user">Réserver une place</span>
</a>


<script>
    function count(){
        var place = document.getElementByTagName(clock);
        var option = place.options[place.selectedIndex].id;
        alert(option);
        var xmlhttp = new XMLHttpRequest();
        xmlhttp.open("GET", "count.php?place=" + place,true);
        xmlhttp.send(null);
        xmlhttp.onreadystatechange = function () {
            if (xmlhttp.readyState == 4 && xmlhttp.status == 200) {
                var reponse = xmlhttp.responseText;
                if(reponse == "yes") {
                    alert("Votre place a été réservé");
                } else {
                    alert("Vous êtes arrivé trop tard !");
                }
            }   
        }
    }
</script>

and here's my php script :

try {
    $db = new PDO('mysql:host=localhost;dbname=projet','root','',array(PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION));
} catch(Exception $e){
    echo $e->getMessage();
    die();
}

$nom = $_GET['place'];
$sq="SELECT place FROM formation WHERE nom='$nom'";
$re = $db->query($sq);

$i = $re->fetch(PDO::FETCH_ASSOC);

if($i > 0){
    $sqq="UPDATE formation SET place = place - 1 WHERE nom='$nom'";
    $res = $db->query($sqq);
    echo 'yes';
} else {
    echo 'no';
}

Answer 1

The first errors are in this line:

var place=document.getElementTagName(clock);

You need to find the element by it's id, not its tag name. Also click is an non-existing variable; you should use "clock" with quotes:

var place=document.getElementById("clock");

That way place will be the select element. But then later you use this in building the URL parameter:

xmlhttp.open("GET","count.php?place="+place,true);

But place is not the selected value; it is the select element, so that will not work right. Instead you should send the value you have in the option variable:

xmlhttp.open("GET","count.php?place="+option,true);

This is assuming that the value of option is correct. Without seeing the HTML and your database table content, this is impossible to say at this moment.

The PHP script has an error here:

$i = $re->fetch(PDO::FETCH_ASSOC);
if($i>0){

You use $i as if it is the selected value, but that is not true. fetch() returns an array with values, in this case an array with one value. The comparison as you have it will always return true , even if the selected place value is 0.

Furthermore you should alter your PHP script so you do not concatenate values into an SQL string, as it makes you vulnerable to SQL injection . Instead use prepared statements .

Also, your PHP script is not working well when there is a lot of concurrency. Imagine that there is one seat left and two make the PHP call at the same time, then both will see there is one place left before the other one has decreased the count, and both will get a "yes".

Instead you should first perform the update and check for availability within the update statement. Then check if the statement updated a record. If not, then there were no places left. As an update statement locks the record during the update, only one process can do it at a time.

Suggested PHP code after database connection is established:

$stmt = $db->prepare("UPDATE formation 
                      SET    place = place - 1 
                      WHERE  nom = ?
                      AND    place > 0");

$stmt->execute(array($_GET['place']));

echo $stmt->rowCount() ? 'yes' : 'no';