将表单值从PHP文件传递到另一个PHP文件

Question

I make a pop-up form like this, in home.php :

<script src="js/submit.js"></script>

.........
.........
.........

<div id="abc">
<!-- Popup Div Starts Here -->

<div id="popupContact">
<!-- Form -->

<form action="#" id="form" method="post" name="form">

    <input id="month" name="month" placeholder="MONTH" type="text">
    <a href="javascript:%20check_empty()" id="submit">ADD</a>

</form>

</div>
<!-- Popup Div Ends Here -->
</div>

I fill the form. When I click 'ADD' button, it runs javascript function. The code in submit.js :

function check_empty() {
    if (document.getElementById('month').value == ""){
        alert("Fill column!");
    } else {
        document.getElementById('form').submit();   
        $.get("application/insertdata.php");
        return false;
    }
}

//Function To Display Popup
function div_show() {
document.getElementById('abc').style.display = "block";
}

//Function to Hide Popup
function div_hide(){
document.getElementById('abc').style.display = "none";
}

I want to run query in insertdata.php as below. It needs the value from 'month'.

<?php 
require("phpsqlajax_dbinfo.php");

$conn = mysqli_connect('localhost', $username, $password, $database);

if (!$conn) {
    die("Connection failed: " . mysqli_connect_error());
} 

$data = isset($_POST['month']);
$monthstring = mysqli_real_escape_string($conn, $data);

$sql = "INSERT INTO `databasea`.`tablea` (`MONTH`, `TEST`) VALUES ('". $monthstring ."', 'xxx');";

mysqli_query($conn, $sql);
mysqli_close($conn);
?>

The query run successfully, and row is added in my table. 'TEST' column is added with 'xxx'. But in 'MONTH' column, it generates no value, just empty.

So, how to get the 'month' value? Thank you.

Answer 1

Since you're using JavaScript/jQuery there is no real need for inline code in your HTML, so let's start there by removing the inline JavaScript:

<script src="js/submit.js"></script>

.........
.........
.........

<form action="#" id="form" method="post" name="form">

<input id="month" name="month" placeholder="MONTH" type="text">
<a href="#" id="submit">ADD</a>

</form>

Much cleaner, no? You weren't passing any data in your function call which may have caused problems for you down the line.

Now a simpler setup in your JavaScript/jQuery in which we'll capture the click event and pass the data via $.post:

$('#submit').click(function(event) {
    event.preventDefault(); // prevent the default click action
    var month = $('#month').val();
    if('' == month) {
        alert('fill the column!');
    } else {
        $.post("application/insertdata.php", {month: month}); // notice how the data is passed
    }
});

So far, so good, the code is much tighter and more readable and it actually posts the data from the form to the AJAX call.

Finally the PHP, testing to see if the variable month is set properly:

<?php 
    require("phpsqlajax_dbinfo.php");

    $conn = mysqli_connect('localhost', $username, $password, $database);

    if (!$conn) {
        die("Connection failed: " . mysqli_connect_error());
    } 

    if(isset($_POST['month'])) {
        $data = $_POST['month'];
        $monthstring = mysqli_real_escape_string($conn, $data);
        $sql = "INSERT INTO `databasea`.`tablea` (`MONTH`, `TEST`) VALUES ('". $monthstring ."', 'xxx');";
        mysqli_query($conn, $sql);
    }

    mysqli_close($conn);
?>

NOTE: I am concerned that you might have more than one of these forms on your page and you may be duplicating ID's which will not work and the duplicate ID's will need to be removed. If this is the case the jQuery code I've written needs to be changed. Here is one way to do that:

$('a').click(function(event) {
    event.preventDefault(); // prevent the default click action
    var month = $(this).prev('input').val(); // get the input next to the link
    if('' == month) {
        alert('fill the column!');
    } else {
        $.post("application/insertdata.php", {month: month}); 
    }
});

---

As I stated in comments Little Bobby says your script is at risk for SQL Injection Attacks. Learn about prepared statements for MySQLi. Even escaping the string is not safe! Changing to prepared statements will make your code cleaner and safer.