[RESOLVED] Insertion problem: 'undefined' inserted to database

[seamres]

I have a form for adding comments which is handled with ajax. The problem is, when the data is inserted into the database, one value inserted is 'undefined'. The other values in the row are inserted perfectly.

<form id='addComment' method='post'>
<input type='hidden' id='blogID' name='blogID' value='$ID'/>
<input type='hidden' id='entryID' name='entryID' value='$entryID'/>
<textarea id='message' name='message' class='newcom'></textarea>
<button class='formbutton' id='addComment'>Add comment</button>
</form>

<script type="text/javascript">
$(document).ready(function(){
	$('#addComment').submit(function()
	{
		var entryID = $('input#entryID').val(); 
		var blogID = $('input#blogID').val();
		var message = $('input#message').val();

	if (message == "")
	{
		alert("Please enter a message.");
	}
	else
	{		
		var datastring = "message=" + message + "&entryID=" + entryID + "&blogID=" + blogID;

		$('input[type=submit]').attr('disabled', true); // to prevent multiple insert at once

		$("#loading").html('<img src="img/loader.gif" align="absmiddle">');

		$.ajax
		({
			type: "POST",
			url: "insertcomment.php",
			data: datastring,
			cache: false,
			success: function(html)
			{
				$("#loading").html('Comment added!');
				$('#comments').append(html);
				$('#comments .comment:first').hide().slideDown('slow'); // for effects only
				$('input[type=submit]').attr('disabled', true); //avoid multiple posting
			}
		});
	}
	return false;
});
});
</script>

<?php session_start();
$con = mysql_connect("localhost","root","");
mysql_select_db("wordscape", $con);
if(isset($_SESSION['logged']) && $_POST['message'])
{	
	$con = mysql_connect("localhost","root","");
	mysql_select_db("wordscape", $con);	

$userID=$_SESSION['userID'];
$username=$_SESSION['username'];

$message=$_POST['message'];
$blogID=$_POST['blogID'];
$entryID=$_POST['entryID'];	

$query="INSERT INTO comment VALUES (NULL, $blogID, $entryID, $userID, '$message', NOW() )";

$queryresult = mysql_query($query, $con);

//getting commenter's avatar
$userquery=mysql_query("SELECT pic FROM avatar WHERE userID=$userID AND selected=1");
if(mysql_num_rows($userquery)>0)
{
	$pic=mysql_fetch_assoc($userquery);
	$avatar=$pic['pic'];	
}
else
{
	$avatar="avatar/avatar.png";
}

//displaying comment
echo "<div class='comment'>";
echo "<a href='user.php?id=$userID'><img src='$avatar'/></a>";
echo "<a href='user.php?id=$userID'><strong>$username</strong></a> <span class='commentdate'>(Just now)</span>";
echo "<p>$message</p>";
echo "</div>";
}
mysql_close($con);	
?>

If it helps, my columns for the comment table are commentID, blogID, entryID, commenter, content, and date.

[NogDog]

Sounds to me like something in the JavaScript, as I don't think PHP ever returns "undefined" on its own, whereas JavaScript does. So, you might want to use FireBug or such to find out where your JS is coming up with that.

[bradgrafelman]

Also note that there's no reason to try to build your own data string for the POST data when jQuery provides a much simpler (and correct, unlike your method) way of doing so: .serialize()

EDIT: I'd also feel remiss if I didn't point out two other things: 1) the entire [man]mysql[/man] extension is outdated and deprecated, and 2) your code is vulnerable to SQL injection attacks and/or just plain SQL errors (see [man]security.database.sql-injection[/man] for more info).

[seamres]

Avoidance measures against SQL injection is something I've yet to learn, so my code still needs a lot of improvement and cleaning up. But the .serialize() method solved my problem, thanks!