Oh how I love rigging JS+PHP+MYSQL!

fender177

Basically what I am doing is sending over from one page a string that is put together by JS....

var query = "INSERT INTO timesheet VALUES('"+st[array_num]+"','"+act[array_num]+"','"+notes[array_num]+"','"+sun[array_num]+"','"+mon[array_num]+"','"+tue[array_num]+"','"+wed[array_num]+"','"+thu[array_num]+"','"+fri[array_num]+"','"+sat[array_num]+"','"+bill[array_num]+"','"+addpay[array_num]+"','"+onsite[array_num]+"','"+ttlhr[array_num]+"','5','100','0&#39😉";

Once it gets to the other page, I can echo $query, and it prints out something like
INSERT INTO timesheet VALUES('EAST','TSIS','test','','8','8','8','8','8','','TRUE','TRUE','TRUE','40','5','100','0')

Which is fine, and when pasted into MySQL directly, works wonderfully... HOWEVER, when I execute the command
$db = mysql_connect("db","user","userpw") or die("Error connecting");
mysql_select_db("intranet") or die("Can not open table");
$result = mysql_query($query) or die ("Query Failed");
it fails...

I am using

$query=$_POST['query'];

to obtain the query... Any ideas?

stolzyboy

take out this line

$result = mysql_query($query) or die ("Query Failed");

and replace with

$result = mysql_query($query) or die (mysql_error());

this will give you a better error to troubleshoot

fender177

good call.. I actually was able to get it working, but creating a hidden for with hidden fields... I think set my php page up to accept the different fields and created the string on that page.

Thanks for the help though.. I think I might go do it the old way just for stz and gglz.

Thanks bro.

k9underdog

Well... don't forget to check where the form was submitted from 😛 I mean, anybody can forge that form's result and obtain different results than the expected ones. Think about it

superwormy

Be careful building queries on the client-side, what if someone made their own page and POST'd it to your PHP script, and the query was:

DELETE FROM tablename

Woudl that mess things up? And you can't trust the HTTP_REFERER variable either to see where the page was POSTd from, that is client side also, and VERY easy to manually change.

k9underdog

How would you change that HTTP_REFERER?

There goes my security method 🙁

fender177

Yea, I did, believe it or not, take that into account... I threw in a "hidden" variable, and that is the users access level. Depending on the access level assigned to them at login (via a cookie) they can either update/insert/delete/query etc...

I also rewrote the page... I took sending the entire string on the client side and trashed that. I, instead wrote a "hidden" form and populate that from the main form, and then send to my PHP page, where I build the query from the hidden form. - After having read your reply, I'm glad I did that, I hadn't even thought about just sending a false query to the php page, good call ;-)

I also plan on throwing in error checks on every field to verify that it is a valid entry ie... an INT field is not a CHAR...

Thanks for the help guys. Its not fun learning from a book and having a timeline haha!

take it easy.