Pass form values from PHP file to another PHP file

Question

I make a pop-up form like this, in home.php :

<script src="js/submit.js"></script>

.........
.........
.........

<div id="abc">
<!-- Popup Div Starts Here -->

<div id="popupContact">
<!-- Form -->

<form action="#" id="form" method="post" name="form">

    <input id="month" name="month" placeholder="MONTH" type="text">
    <a href="javascript:%20check_empty()" id="submit">ADD</a>

</form>

</div>
<!-- Popup Div Ends Here -->
</div>

I fill the form. When I click 'ADD' button, it runs javascript function. The code in submit.js :

function check_empty() {
    if (document.getElementById('month').value == ""){
        alert("Fill column!");
    } else {
        document.getElementById('form').submit();   
        $.get("application/insertdata.php");
        return false;
    }
}

//Function To Display Popup
function div_show() {
document.getElementById('abc').style.display = "block";
}

//Function to Hide Popup
function div_hide(){
document.getElementById('abc').style.display = "none";
}

I want to run query in insertdata.php as below. It needs the value from 'month'.

<?php 
require("phpsqlajax_dbinfo.php");

$conn = mysqli_connect('localhost', $username, $password, $database);

if (!$conn) {
    die("Connection failed: " . mysqli_connect_error());
} 

$data = isset($_POST['month']);
$monthstring = mysqli_real_escape_string($conn, $data);

$sql = "INSERT INTO `databasea`.`tablea` (`MONTH`, `TEST`) VALUES ('". $monthstring ."', 'xxx');";

mysqli_query($conn, $sql);
mysqli_close($conn);
?>

The query run successfully, and row is added in my table. 'TEST' column is added with 'xxx'. But in 'MONTH' column, it generates no value, just empty.

So, how to get the 'month' value? Thank you.

First of all you need to study $.get function. See this link for $.get() api.jquery.com/jquery.get — Nikhil Vaghela
– Nikhil Vaghela, Commented Jun 24, 2016 at 12:57
Little Bobby says your script is at risk for SQL Injection Attacks. Learn about prepared statements for MySQLi. Even escaping the string is not safe! — Jay Blanchard
– Jay Blanchard, Commented Jun 24, 2016 at 12:58
You are posting the form with: document.getElementById('form').submit(); but you got no URL in the forms action, which means that it will post to itself. Then you do a $.get to the correct file... but $.get does a GET-request, not POST... and you're not sending any data. — M. Eriksson
– M. Eriksson, Commented Jun 24, 2016 at 12:59
I'm guessing your MONTH field is a string, but your $monthstring variable is a boolean because it's defined as the escaped version of $data = isset($_POST['month']); which is a boolean — apokryfos
– apokryfos, Commented Jun 24, 2016 at 13:01

Community · Accepted Answer · 2017-05-23 11:58:51Z

2

Since you're using JavaScript/jQuery there is no real need for inline code in your HTML, so let's start there by removing the inline JavaScript:

<script src="js/submit.js"></script>

.........
.........
.........

<form action="#" id="form" method="post" name="form">

<input id="month" name="month" placeholder="MONTH" type="text">
<a href="#" id="submit">ADD</a>

</form>

Much cleaner, no? You weren't passing any data in your function call which may have caused problems for you down the line.

Now a simpler setup in your JavaScript/jQuery in which we'll capture the click event and pass the data via $.post:

$('#submit').click(function(event) {
    event.preventDefault(); // prevent the default click action
    var month = $('#month').val();
    if('' == month) {
        alert('fill the column!');
    } else {
        $.post("application/insertdata.php", {month: month}); // notice how the data is passed
    }
});

So far, so good, the code is much tighter and more readable and it actually posts the data from the form to the AJAX call.

Finally the PHP, testing to see if the variable month is set properly:

<?php 
    require("phpsqlajax_dbinfo.php");

    $conn = mysqli_connect('localhost', $username, $password, $database);

    if (!$conn) {
        die("Connection failed: " . mysqli_connect_error());
    } 

    if(isset($_POST['month'])) {
        $data = $_POST['month'];
        $monthstring = mysqli_real_escape_string($conn, $data);
        $sql = "INSERT INTO `databasea`.`tablea` (`MONTH`, `TEST`) VALUES ('". $monthstring ."', 'xxx');";
        mysqli_query($conn, $sql);
    }

    mysqli_close($conn);
?>

NOTE: I am concerned that you might have more than one of these forms on your page and you may be duplicating ID's which will not work and the duplicate ID's will need to be removed. If this is the case the jQuery code I've written needs to be changed. Here is one way to do that:

$('a').click(function(event) {
    event.preventDefault(); // prevent the default click action
    var month = $(this).prev('input').val(); // get the input next to the link
    if('' == month) {
        alert('fill the column!');
    } else {
        $.post("application/insertdata.php", {month: month}); 
    }
});

As I stated in comments Little Bobby says your script is at risk for SQL Injection Attacks. Learn about prepared statements for MySQLi. Even escaping the string is not safe! Changing to prepared statements will make your code cleaner and safer.

edited May 23, 2017 at 11:58

CommunityBot

11 silver badge

answered Jun 24, 2016 at 13:14

Jay Blanchard

34.5k17 gold badges82 silver badges130 bronze badges

Sign up to request clarification or add additional context in comments.

8 Comments

M. Eriksson Over a year ago

Just one small suggestion. Validate the $_POST['month'] before you open the DB-connection. No need to open it if the variable isn't set. :)

Jay Blanchard Over a year ago

That's not a bad idea @MagnusEriksson, I was just trying not to modify the OP's code too much.

M. Eriksson Over a year ago

And $sql won't be set if the validation fails, but is used after. :) mysqli_query($conn, $sql); should be in the IF-statement.

Jay Blanchard Over a year ago

Good catch @MagnusEriksson, I changed the code a little to reflect that.

Graha Pramudita Over a year ago

hi @JayBlanchard thank you. I tried your code, but when I click ADD button, my pop-up form doesn't show up now. (I have edited my full code above in home.php and submit.js, take a look)

|

Passionate Coder · Accepted Answer · 2016-06-24 12:57:04Z

2

Hi use $data = $_POST['month'];

isset will return true or false not value of month

answered Jun 24, 2016 at 12:57

Passionate Coder

7,3042 gold badges24 silver badges50 bronze badges

Comments

Adder · Accepted Answer · 2016-06-24 12:57:41Z

2

Replace

$data = isset($_POST['month']);

by

if(isset($_POST['month'])) {
   $data=$_POST['month'];
}

answered Jun 24, 2016 at 12:57

Adder

5,8982 gold badges35 silver badges60 bronze badges

1 Comment

Jay Blanchard Over a year ago

There are so many other things wrong with the code before things even get here.

Collectives™ on Stack Overflow

Pass form values from PHP file to another PHP file

3 Answers 3

8 Comments

Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

8 Comments

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related