由jQuery提交的表单不会在DDBB上插入

Question

I have a simple form that I am trying to submit by jQuery. This is it:

        <form id="turn_conf" action='turn_insert.php' method="POST">
                    <label for="nombre">Nombre:</label>
                    <input type="text" id="tu_name" name="tu_name">         
                    <input type="submit" class="botonEnvio" value="Crear">
        </form>

And a jQuery function that by the moment does not seem to work, neither the "It seems I'm working" alert is displayed on screen

    $('#turn_conf').on('submit', validaDatos)

function validaDatos(e) {
    var nombreTurno = $('input[name=tu_name]').val();

    $.post({url: $(this).attr('action'),
            data: { tu_name:nombreTurno },
            success:feedback })
    e.preventDefault(); }

function feedback (datos) {
    alert("Seems I'm working!")}

No value is being inserted on DDBB. Here you have what is on the insert PHP file "turn_insert.php":

$nombreTurno = $_POST['tu_name'];

$insertar = mysql_query("INSERT INTO turn_conf (tu_id,tu_name,tu_status) VALUES ('','$nombreTurno','1')");

Console shows error: error on console: POST localhost/Gestion/%5Bobject%20Object%5D 404 Not Found

Any suggestion about what is going wrong here? Thank you in advance.

Answer 1

First the success argument is being passed the result of feedback because you are calling it rather than passing the reference to the function. Also you are using the $.ajax version by passing an object to the method. $.post breaks the object down into parameters. Change to:

$.post($(this).attr('action'), { tu_name:nombreTurno }).success(feedback);

Second never pass user input straight into your SQL queries. You are open to SQL injection and all kinds of nastiness. Use bound parameters: http://www.php.net/manual/en/pdostatement.bindparam.php