return a php file content using .ajax()

Question

so I have a file that will get $_GET['id'] from an ajax request here is a part of the php file:

include "system/dbconnect.php";
// Script Bin Plugin
$id = $_GET['id']; 

 $hresult = mysql_query("SELECT * FROM options
 WHERE id='$id'") or die(mysql_error()); 
  echo '<ul class="ul"> more content goes here...';

I edited the question to make it clearer: I would like to return the file's content, the html and mysql results going through a loop then rendering the widgets that contain different info from the db using ajax ...

You mean you have the name of a file and you want to output the contents of the file? — Michael Mior
– Michael Mior, Commented Feb 17, 2012 at 1:39
It's unclear what you want to do here. Do you want to print anything echod by your PHP file back to the browser? — Bojangles
– Bojangles, Commented Feb 17, 2012 at 1:41
well its a file that will render 18 different divs (widgets)each div will the render different information from the db. I have a file handler.php that checks the table for active=yes widgets and then will display all of them through a loop — cppit
– cppit, Commented Feb 17, 2012 at 1:53

Community · Accepted Answer · 2023-11-17 20:38:18Z

2

You really should escape variables passed via GET:

$id = mysql_real_escape_string(intval($_GET['id']));

Then you can simply run a loop using mysql_fetch_assoc:

$hresult = mysql_query("
    SELECT * FROM `options` WHERE `id` = '{$id}'"
) or die(mysql_error());
echo '<ul class="ul">';
while ($row = mysql_fetch_assoc($hresult)) {
    echo '<li>' . $row['value'] . '</li>';
}
echo '</ul>';

edited Nov 17, 2023 at 20:38

CommunityBot

11 silver badge

answered Feb 17, 2012 at 1:41

Rusty Fausak

7,5541 gold badge30 silver badges39 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

ThiefMaster Over a year ago

For an ID, intval() would be more appropriate.

ThiefMaster Over a year ago

Actually, escaping is not necessary after converting to an int since there is nothing to escape in a numeric value, ever.

Rusty Fausak Over a year ago

True, I'm just in the habit of not trusting myself to be smart enough to make that call most of the time :)

ThiefMaster Over a year ago

That's why it's better not to use dynamic sql at all but use e.g. PDO with prepared statements! And when that's no an option I usually do the escaping right when I build the query - you usually don't want sql-escaped variables floating around anyway, since you might accidentally send them back to the browser; presenting ugly backslashes to the user.

cppit Over a year ago

I am looping through include to display each file based on the settings its working fine thank you guys. and thanks for the mysql_real_escape_string very useful

Collectives™ on Stack Overflow

return a php file content using .ajax()

1 Answer 1

5 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

5 Comments

Your Answer

Sign up or log in

Post as a guest

Related