0

I generated a form when a user presses a button with this code:

var sql = "SELECT * FROM categories WHERE ID = " + id;
    var result = db.query(sql, {json:true});
    var obj = JSON.parse(result);
    var parsedlength = arrLenght(obj);

    var main = document.getElementById('main');
    var modal = document.createElement('div');

    for(var i = 0; i < parsedlength; i++) {
        var object = obj[i];
        for (var key in object) {
            if(object.hasOwnProperty(key)) {
                modal.className = 'modal fade bd-example-modal-lg';
                modal.id = "editModal";
                modal.role = "dialog";
                modal.innerHTML = '<div class="modal-dialog modal-lg"><div class="modal-content"><div class="modal-header">'+
                        '<button type="button" class="close" data-dismiss="modal" aria-label="Close"  onclick="deleteElement(\'editModal\')">'+
                            '<span aria-hidden="true">&times;</span>'+
                        '</button>'+
                        '<h4 class="modal-title">Bewerken van categorie: ' + object['ConName'] + '</h4>'+
                    '</div>'+
                    '<div class="modal-body" style="background-image: url(\'' + object['img'] + '\')">'+
                    '<div class="row">'+
                    '<label for="cat-name" class="col-md-12 col-xs-12 col-form-label">Naam:</label>'+
                        '<div class="col-md-12 col-xs-12">'+

                            '<input class="form-control" type="text" value="' + object['ConName'] + '" placeholder="Categorie" id="cat-name" name="cat-name">'+
                        '</div>'+
                        '<label for="cat-name" class="col-md-12 col-xs-12 col-form-label">Afbeelding:</label>'+
                        '<div class="col-md-9 col-xs-12">'+
                            '<input type="text" name="cat-path-show" id="cat-path-show" class="form-control" placeholder="afbeelding" readonly>'+
                            '<input type="file" name="cat_path_update" id="cat-path-update" style="position: absolute; top:-10000px;">'+
                        '</div>'+
                        '<div class="col-md-3 col-xs-12"><button id="update-cat-img" class="btn btn-info" onclick="updateList()">afbeelding kiezen</button></div>'+
                    '</div>'+
                    '</div>'+
                    '<div class="modal-footer">'+
                        '<div class="btn-group">'+
                            '<button type="button" class="btn btn-danger" data-dismiss="modal" onclick="deleteElement(\'editModal\')">Annuleer</button>'+
                            '<button type="button" class="btn btn-primary" data-dismiss="modal" onclick="saveCatEdit();deleteElement(\'editModal\')">Opslaan</button></div>'+
                        '</div>'+
                    '</div>'+
                '</div>';
            }
        }
        window.setTimeout(function() {
            main.appendChild(modal);
            $('#editModal').modal('show')
        }, 100);
        object = null;
        var obj = null;

as you can see, there is a button called "afbeelding kiezen", with an ID of "update-cat-img" that triggers the function updateList() this function clicks on the file input. the problem is detecting the change event, because the form is appended after the entire page is loaded, I can't add an addEventListener, listening for the file input value to change.

this is what I've tried, but ofcourse, it doesn't work. how would I be able to change the value of fileView to the value of file when the value of file is changed?

function updateList() {
    var file = document.getElementById('cat-path-update');
    var fileView = document.getElementById('cat-path-show');
    file.click();
    file.addEventListener('change', function() {
        m();
        fileView.value = file.value;
    }, false);
    m(file.value);

}
6
  • Wow.. nice example for SQL injections.. Commented Nov 22, 2016 at 12:26
  • Is the updateList function being called correctly? Commented Nov 22, 2016 at 13:14
  • @Lain yes I know, it's not for an online version, and these functions will only be able to be accessed by certain users on the PC, and, off topic comment. Commented Nov 22, 2016 at 13:32
  • First, I would try to add the change event before the click(). Also file inputs have no .value.. they have .files. Commented Nov 22, 2016 at 13:50
  • @Lain that fixed it, and they do have a value attribute Commented Nov 22, 2016 at 14:03

1 Answer 1

1

Be sure to add the change event before the call. Here is an example:

//HTML-Template
var tHTML = (function(){/*
    <div>
        <div><span id = 'sName'>-</span></div>
        <div><input id = 'inFile' name = 'inFile' type = 'file' /></div>
    </div>
*/}).toString().split('/*').pop().split('*/')[0].trim();

//Append HTML
document.body.innerHTML += tHTML;

//Add change event
var tF = document.querySelector('#inFile');
tF.onchange = function(){
    if(this.files && this.files.length){
        var tS = document.querySelector('#sName');
        tS.textContent = this.files[0].name
    }
};

//Execute
tF.click();
Sign up to request clarification or add additional context in comments.

3 Comments

also, just as a side note, you stated that this is greatly vounreble to sql injection, I usually don't work with sql so I don't know much about how a user would do this, could you please explain how my code is vounreble to this and maybe how to prevent it?
Well, let's say someone changed your var sql to "SELECT * FROM categories WHERE ID = ID; drop table categories;--". What do you think would happen?
it'd drop the table, this is why I usually don't work with sql directly. but yea, I should probably build in a safe to prevent this right away. even though you can only write to the database on a specific account on the PC itself

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.