Pass variable value from JS to PHP

Question

I have a problem in passing a value from JS to PHP so that it can be used as a parameter for a PHP function. The JS function will be trigger by onclick event once the link was clicked. Here is the JS + HTML code:

<script type="text/javascript">
   function insertIntoDb() {
      $.GET OR POST("insert.php");
      return false;
   }
</script>

<a href="#" onclick="insertIntoDb();">INSERT MY USERNAME</a>

PHP (insert.php):

<?php
    session_start();

    function insert($username){
        $username = mysql_real_escape_string($username);
        $query = mysql_query("INSERT INTO List(Username) VALUES('$username')") or die(mysql_error());
    }

    if(isset($_POST['Username'])){
        insert($_POST['Username']);
    }
?>

Thank you for the one who can help me.. I am very new to PHP and JS so please forgive my stupidity.

Wow--wish I could add a million points for your username. I just laughed so hard at that I might have peed myself. Don't have an answer for ya though. Sorry. — Matt Cashatt
– Matt Cashatt, Commented Dec 29, 2011 at 1:02
There's a pretty important security flaw here. You need to somehow make sure that people can't just send HTTP requests to your server, and it'll insert stuff into the database, because that can ruin your life. — Dhaivat Pandya
– Dhaivat Pandya, Commented Dec 29, 2011 at 1:02
simple CSRF reference here: codeutopia.net/blog/2008/10/16/… — Joseph
– Joseph, Commented Dec 29, 2011 at 1:06
You change the INSERT link to a REMOVE link, and a malicious user can still bypass all that by submitting their own requests with dev tools. — nnnnnn
– nnnnnn, Commented Dec 29, 2011 at 1:21

beerwin · Accepted Answer · 2011-12-29 08:06:53Z

1

index.html

<script src="http://code.jquery.com/jquery-latest.min.js" type='text/javascript'></script>
<script>
   $(document).ready(function(){ 
       $("#insert").click(function(event){
           $.post('insert.php',{username:$(this).html()});
       })
   });
</script>
<a href='javascript:void(0);' id='insert'>Username</a>

insert.php

<?php
function insert($username){
    $conn = mysql_connect("host","user","passwd");
    if($conn){
        $username =  mysql_real_escape_string($_POST['username']);
        $result = mysql_query("INSERT INTO test.user(username) VALUES('".$username."')") or die(mysql_error());
        mysql_close($conn);
    }
}
if(isset($_POST['username'])){
    insert($_POST['username']);
}
?>

edited Dec 29, 2011 at 8:06

beerwin

10.5k6 gold badges45 silver badges60 bronze badges

answered Dec 29, 2011 at 7:11

Priya

1,5541 gold badge14 silver badges33 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

jermel · Accepted Answer · 2011-12-29 01:36:22Z

0

You pass data from the browser to your server. Javascript is a language for manipulating the browser. PHP is your server side language.

You can pass data in a get or post request such as "mypage.php?Username=john"

What you want is a form so that you can interact with the user

<script type="text/javascript">
    function insertIntoDb() {
      document.getElementById("myform").submit();
      //or if you want to use jquery and ajax
      $.post("insert.php", $("#myform").serialize());
      return false;
    }
</script>

<form id="myform" method="post" action="insert.php">
    <a href="#" onclick="insertIntoDb();">INSERT MY USERNAME</a>
    <input type="text" name="Username"></input>
</form>

answered Dec 29, 2011 at 1:36

jermel

2,32621 silver badges19 bronze badges

Collectives™ on Stack Overflow

Pass variable value from JS to PHP

2 Answers 2

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related