views:

18

answers:

1

Hi, I am using jQuery UI autocomplete and I am relatively new to jQuery and JSON. Below is my code. I was wondering if it is possible to specify the field name and data table name inside the callback url so that the php file grabs it later. I have many input box with different names and ids which need to have autocomplete. Each input box relates to different column and data table in MySQL. So i actually want to replace "SELECT * FROM projects WHERE project_title REGEXP '.$param'"; into something like "SELECT [column variable] FROM [data table variable] WHERE [column variable] REGEXP '.$param'";

Thank you a lot in advance.

Abu

<script type="text/javascript">
        $(function(){

            //attach autocomplete
            $("#project-title").autocomplete({

                //define callback to format results
                source: function(req, add){

                    //pass request to server
                    $.getJSON("bin/test.php?callback=?", req, function(data) {

                        //create array for response objects
                        var suggestions = [];

                        //process response
                        $.each(data, function(i, val){                                
                            suggestions.push(val.name);
                        });

                        //pass array to callback
                        add(suggestions);
                    });
                },
                minLength: 1,


            });
        });

Below is test.php file

<?php

include('../db.php');
$param = $_GET["term"];

//query the database
$query = "SELECT * FROM projects WHERE project_title REGEXP '.$param'";
$res = connect($query);
//build array of results
for ($x = 0, $numrows = mysql_num_rows($res); $x < $numrows; $x++) {
    $row = mysql_fetch_array($res);

    $friends[$x] = array("name" => $row["project_title"]);
}

//echo JSON to page
$response = $_GET["callback"] . "(" . json_encode($friends) . ")";
echo $response;

?>

A: 

Never mind. I figured it out. I used something like this.

$.getJSON("bin/test.php?callback=?&table=projects&col=project_title", req, function(data) 

than grab the extra values using this

$param = filter_input(INPUT_GET, 'term', FILTER_SANITIZE_STRING);
$param_table = filter_input(INPUT_GET, 'table', FILTER_SANITIZE_STRING);
$param_column = filter_input(INPUT_GET, 'col', FILTER_SANITIZE_STRING);
Abu
I still would like to know how i can make it more secure. Thank you.
Abu
this won't help you even a little bit
Col. Shrapnel
The page is not public anyway. It has a secure login system. I added the no-cache header and also header("Content-Type: application/json; charset=utf-8"); And am using the more secure filter_input. If u know more ways to secure even after that I would love to hear them. Thanks
Abu
All this nonsense you've used has nothing to do with main problem - an SQL injection. To avoid this, you have to have list of every field of every table hardcoded in your script.
Col. Shrapnel
thanks for pointing it out. Being a novice, i didn't know that.
Abu
..i hardcoded every fieldname and table name in the script. i also added mysql_real_escape_string.
Abu