Directly Post Info Of Option Selected

chris_php

Hello everyone,
I'm trying to make a page that has a select input. When you click an option, it displays automatically the information about the option selected in a div. But when I select an option nothing really happens..
The code now is something like this:

main.php

<html>

<head>

    <script type="text/javascript" src="../JQuery.js"></script>

    <script type="text/javascript">
    jQuery(document).ready(function(){
            jQuery('#Client_ID').live('change', function(event) {
                    $.ajax({
                            url      : 'getData.php',
                            type    : 'POST',
                            dataType: 'json',
                            data    : $('#myform').serialize(),
                            success: function( data ) {
                                       for(var id in data) {                
                                                      $(id).val( data[id] );
                                       }
                            }
                    });
            });
    });
    </script>

</head>

<body>

    <form id='myform'>
     <select name='Client_ID' id='Client_ID'>
       <option value=''>Select</option>
       <option value='1'>Roy</option>
       <option value='2'>Ralph</option>
     </select>

     <div name='address1' id='address1'>
     <div name='address2' id='address2'>
    </form>

</body>


</html>

getData.php:

<?php

include('../content/Conx.php');

$clientId = $_POST['Client_ID']; // Selected Client Id

$query  = "SELECT nom, prenom FROM client where nom = $clientId";
$result = mysql_query($query) or die(mysql_error());
$row = mysql_fetch_array($result,projet);

$add1 = $row[nom];
$add2 = $row[prenom];

$arr = array( 'div#address1' => $add1, 'div#address2' => $add2);
echo json_encode( $arr );

?>

I need help :/

bradgrafelman

Your PHP script has several issues to start with:

Stop Using the MySQL Extension!
You should never place user-supplied data directly into a SQL query string, else your code will be vulnerable to SQL injection attacks and/or just plain SQL errors. Instead, you must first sanitize the data such as by using [man]mysqli_real_escape_string_data/man for string data or by using prepare statements. (Note that one method for sanitizing integer data is by casting to (int) or by using the [man]intval/man function.)

See [man]security.databases.sql-injection[/man] for more info on the topic of SQL injections (and, more importantly, how to protect your code against them).
Do you have the error_reporting PHP directive set to E_ALL (or better) and log_errors set to On? If no to either... why not?
Stop using the "... or die()" construct. It might be a quick-and-dirty approach to debugging while developing, but it quickly loses value (especially when we're talking about AJAX interactions). Instead, consider logging helpful information about the problem that occurred and then gracefully handling the return/output as necessary.
```
$row = mysql_fetch_array($result,projet);
```
Two issues with this statement:
1. You didn't [man]define/man a [man]constant[/man] named projet, so PHP is going to assume you meant the [man]string[/man] "projet" here instead. You should also be getting an error message alerting you to this... unless, of course, your answer to #3 above was "No, I don't want PHP to try to help me when my code may or may not have problems."
2. The string "projet" is not a valid value for the second parameter for [man]mysql_fetch_array/man. In fact, the second parameter shouldn't even be a string at all.
```
$add1 = $row[nom]; 
$add2 = $row[prenom]; 
```
Two more problems with these two statements:
1. You never checked to see if you were able to successfully fetch a row from the result set (meaning $row could be boolean FALSE here and not an array of values). Just because the query was successfully executed doesn't mean you will be able to fetch any results from it.
2. Same issue with constants vs. strings here - you never defined any constants named nom or prenom - perhaps you meant the strings 'nom' and 'prenom' instead?

chris_php

Thanks a lot first of all!! 🙂

Ok I heard everything you said and I fixed up my code a little bit..
For the injections I'll worry about them later on

the main.php is now:

<html>

<head>
	<?php
		ini_set('display_errors', 1 );
		error_reporting(E_ALL);
	?>

<script type="text/javascript" src="../JQuery.js"></script>

<script type="text/javascript">
jQuery(document).ready(function(){
            jQuery('#Client_ID').live('change', function(event) {
                    $.ajax({
                            url      : 'getData.php',
                            type    : 'POST',
                            dataType: 'json',
                            data    : $('#myform').serialize(),
                            success: function( data ) {
                                       $("#address1").val( data["address1"] );
                                       $("#address2").val( data["address2"] );
                            }
                    });
            });
    });
</script>

</head>

<body>

<form id='myform' method='post'>
 <select name='Client_ID' id='Client_ID'>
   <option value=''>Select</option>
   <option value='Roy'>Roy</option>
   <option value='Ralph'>Ralph</option>
 </select>

 <div name='address1' id='address1'>
 <div name='address2' id='address2'>
</form>

</body>


</html>

and the getData.php

<?php
		ini_set('display_errors', 1);
		error_reporting(E_ALL);


	include('../content/Conx.php');

	$clientId = $_POST['Client_ID'];
	$db = "projet";

	$query  = "SELECT nom, prenom FROM client WHERE nom = '$clientId' ";
	$result = mysql_query($query);
	$row = mysql_fetch_array($result);

	$add1 = $row["nom"];
	$add2 = $row["prenom"];

	$arr = array( 'address1' => $add1, 'address2' => $add2);
	echo json_encode( $arr );

?>

I learned some couple of basic things in debugging and finally used the firebug to know what it displaying

In firebug it says that it displays

{"address1":"Roy","address2":"Maroun"}

Which is 100% correct..
But it wont show up in the main.php ...