通过获取用户ID并发送AJAX调用来更新数据库

Question

I have a page that I accept or deny new users. When someone is accepted they go to a section called Accepted Users and in that section the admin have to change their permission level or group#. So in the following I am getting the user_id from the user_request table for that specific user and wanting to update my users table by the id. I am only wanting to update the 'group' by the option box through an AJAX call to my php file.

Does anyone see what I'm doing wrong? Nothing is being updated into my db. I get no errors in the console,

<?php
$con2 = mysqli_connect("localhost", "root", "", "db");
$run2 = mysqli_query($con2,"SELECT * FROM user_requests ORDER BY id DESC");
$runUsers2 = mysqli_query($con2,"SELECT * FROM users ORDER BY id DESC");
$numrows2 = mysqli_num_rows($run2);

    if( $numrows2 ) {
        while($row2 = mysqli_fetch_assoc($run2)){
            if($row2['status'] == "Approved"){

                $approved_id        = $row2['user_id'];
                $approved_firstname = $row2['firstname'];
                $approved_lastname  = $row2['lastname'];
                $approved_username  = $row2['username'];

    if ($approved_firstname == true) {
        echo "Name - ". $approved_firstname . " " . $approved_lastname . "</br>" . 
                "Username - ". $approved_username . "</br></br>"
?>
<div class="change_group_button"> 
     <a class="change_group" href="javascript:void(0)">Change User Permission</a>
</div><br>
<div id="light" class="change_group_popup">
    <a class="close" href="javascript:void(0)">Close</a>

    <form id="update_group" name="Group" action="" method="POST" accept-charset="utf-8">
       <div class="field">
        <label for="group">Group</label>
        <select value='<?php echo $approved_id; ?>' id='approved_id' name='group' required>
            <option value=''><?php echo htmlentities($group); ?></option>
            <option value="1">Bench</option>
            <option value="2">Spectator</option>
            <option value="3">Team Member</option>
            <option value="4">Commissioner</option>
        </select>
    </div>
    <input type="submit" value="submit">
    </form>

AJAX call. I am not sure if my data part is right..

//AJAX call for updating the group
$(document).ready(function () {

    $('#update_group').on('submit', function (event) {
    event.preventDefault();
        $.ajax({
            url: 'user_group_update.php',
            type: 'POST',
            data: {
                id: $(this).val(), //id
                update_group: $(this).val() //group level
            },
            success: function (data) {
                //do something with the data that got returned
                $("#success").fadeIn();
                $("#success").show();
                $('#success').html('User Permission Level Changed!');
                $('#success').delay(5000).fadeOut(400);
            },
             error: function(jqXHR, textStatus,errorThrown )
            {
              // alert on an http error 
              alert( textStatus +  errorThrown );
            }
        });
        return false;
    });
});

user_group_update file

$approved_id = $_POST['id'];
$change_group = $_POST['update_group'];

$con = mysqli_connect("localhost","root","","db");
    /* check connection */
    if (mysqli_connect_errno()) {
        printf("Connect failed: %s
", mysqli_connect_error());
        exit();
    }
    $stmt = $con->prepare("UPDATE users SET group=? WHERE id=?");
    if ( false===$stmt ) {
     // Check Errors for prepare
        die('User Group update prepare() failed: ' . htmlspecialchars($con->error));
    }
    $stmt->bind_param('si', $change_group, $approved_id);
    if ( false===$stmt ) {
    // Check errors for binding parameters
        die('User Group update bind_param() failed: ' . htmlspecialchars($stmt->error));
    }
    $stmt->execute();
    if ( false===$stmt ) {
        die('User Group update execute() failed: ' . htmlspecialchars($stmt->error));
    }

Answer 1

I see some problems:

1) you are combining the group id and approved id into one select element. that's not how forms work. you need a separate field for approved id, something like:

<input type="hidden" value="<?php echo $approved_id; ?>" id="approved_id" name="id" />
<select id='group_id' name='group' required>
    <option value=''><?php echo htmlentities($group); ?></option>
    <option value="1">Bench</option>
    <option value="2">Spectator</option>
    <option value="3">Team Member</option>
    <option value="4">Commissioner</option>
</select>

2) your data array should look like this:

data: {
    id: $("#approved_id").val(), //id
    update_group: $("#group_id").val() //group level
}

3) error checking is wrong in user_group_update, should be:

$stmt = $con->prepare("UPDATE users SET group=? WHERE id=?");
if ( !$stmt || $con->error ) {
 // Check Errors for prepare
    die('User Group update prepare() failed: ' . htmlspecialchars($con->error));
}
if(!$stmt->bind_param('si', $change_group, $approved_id)) {
// Check errors for binding parameters
    die('User Group update bind_param() failed: ' . htmlspecialchars($stmt->error));
}
if(!$stmt->execute()) {
    die('User Group update execute() failed: ' . htmlspecialchars($stmt->error));
}