GET and XMLHttpRequest

Question

i have an XMLHttpRequest.The request passes a parameter to my php server code in /var/www. But i cannot seem to be able to extract the parameter back at the server side. below i have pasted both the codes:

javascript:

function getUsers(u)
{ 
 alert(u);//here u is 'http://start.ubuntu.com/9.10'
 xmlhttp=new XMLHttpRequest();
 var url="http://localhost/servercode.php"+"?q="+u;

 xmlhttp.onreadystatechange= useHttpResponse;
 xmlhttp.open("GET",url,true);
 xmlhttp.send(null);
}

function useHttpResponse() 
{

 if (xmlhttp.readyState==4 )
 {
 var response = eval('('+xmlhttp.responseText+')');
  for(i=0;i<response.Users.length;i++)
        alert(response.Users[i].UserId);

 }
}

servercode.php:

 <?php
$q=$_GET["q"];
//$q="http://start.ubuntu.com/9.10";
$con=mysql_connect("localhost","root","blaze");
if(!$con)
{die('could not connect to database'.mysql.error());
}
mysql_select_db("BLAZE",$con) or die("No such Db");
$result=mysql_query("SELECT * FROM USERURL WHERE URL='$q'");

 if($result == null)
 echo 'nobody online';
 else
  {
  header('Content-type: text/html');
  echo "{\"Users\":[";
  while($row=mysql_fetch_array($result))
  {
   echo '{"UserId":"'.$row[UsrID].'"},';
  }
  echo "]}";
  }
mysql_close($con);
?> 

this is not giving the required result...although the commented statement , where the variable is assigned explicitly the value of the argument works...it alerts me the required output...but somehow the GET method's parameter is not reaching my php or thats how i think it is....pls help....

Answer 1

If u is http://start.ubuntu.com/9.10 as you write, the URL gets garbled because : is a forbidden character in a URL.

You need to escape the URL using encodeURIComponent() in Javascript, and urldecode() it back in PHP. Docs here and here.

The JavaScript part would look like so:

 var url="http://localhost/servercode.php"+"?q="+encodeURIComponent(u);

and the PHP part:

 $q=urldecode($_GET["q"]);

your mySQL query is also vulnerable to a SQL injection, which is highly dangerous. You should at least sanitize $q using mysql_real_escape_string(). See this question for an overview on the problem, and possible solutions.