得到错误的回应

Question

I got the following code and I don't find the mistake. When i execute it, I always get "no_request".

$username is equal to Reebal and $user is equal Simon

Ajax/jQuery

$("#cancel_friend").click(function(e){
    var user = "<?php echo $user_username; ?>";
    var type = "cancel_friend"
    $.ajax({
        type: "POST",
        url: "../system/friend_system.php",
        data: {
            user: user,
            type: type
        },
        success: function(data, status){
            if(data == "friend_request_canceled"){
                $("#cancel_friend").css("display", "none");
            }else{
                $(".error_msg_container").html(data);
            }
        },
        error: function(){
            alert(data);
        }

friend_system.php

}else if($_POST['type'] == "cancel_friend"){
    $sql = "SELECT COUNT(id) friends WHERE user1 = '$username' AND user2 = '$user' AND accepted='0' LIMIT 1";
    $result = mysqli_query($conn, $sql);
    $request = mysqli_fetch_row($result);
    if($request[0] > 0){
        $sql = "DELETE FROM friends WHERE user1 = '$username' AND user2 = '$user' AND accepted='0' LIMIT 1";
        $result = mysqli_query($conn, $sql);
        mysqli_close($conn);
        echo "friend_request_canceled";
        exit();
    }else{
        echo "no_request";
        exit();
    }

Here is the friends table:

Hope you can help me.

Answer 1

Right now on my phone so I can't look at it that well, your SQL Query is unsafe. Use either mysqli or pdo. And you forgot the FROM your the sql query, here's an sql injection safe code:

$con = new PDO("mysql:host=localhost;dbname=dbName" , "dbPassword","dbUsername"); // connecting with PDO
$query = $con->prepare("SELECT COUNT(id) FROM friends WHERE user1 = :username AND user2 = :username2 AND accepted = \"0\" LIMIT 1"); // Preparing a query
$query->bindParam(":username" , $username,  PDO::PARAM_STR); // binding parameters in a safe way
$query->bindParam(":username2",$username2,PDO::PARAM_STR); 
$query->execute();
$result = $query->fetchAll(); // fetching the result and putting it in result

REMEMBER TO CHANGE THE VARIABLES AND MODIFY THE CONNECTION DETAILS If it doesn't work comment not this comment