Geek asks and answers

Insert form value into SQL query using jquery or javascript

I have the following fields in the form. The page uses .Net and MS SQL

<input type="text" name="Title" id="Title" />
<input type="text" name="FirstName" id="FirstName" />
<input type="text" name="LastName" id="LastName" />

I would like to be able to capture these values ​​and write them to the SQL query further in the same form ...

SELECT LastApp, 
FROM   kb_xmod_modules 
WHERE  infby1 = 'Dr Brian Cox'

In this example, Dr. Brian Cox will be replaced with any values ​​entered in Title, FirstName and LastName

If anyone has any ideas, that would be great ...

thank

+3
source share
3 answers
<form id="myForm">
<input type="text" name="Title" id="Title" />
<input type="text" name="FirstName" id="FirstName" />
<input type="text" name="LastName" id="LastName" />
<input type="submit"/>
</form>

$(function() {
   $('#myForm').submit(function(){
      var query = $(this).serialize();
      $.post("post.php", query);
      return false;
  });
});

now your post.php page will get values $_POSTsimilar to this:

$_POST['FirstName'] . $_POST['LastName'] .  $_POST['Title']

So

SELECT LastApp, 
FROM   kb_xmod_modules 
WHERE  infby1 = '".mysql_real_escape_string($_POST['FirstName'].' '.$_POST['LastName'])."'
+1
source

You need to do this for the where clause:

WHERE infby1 = "'" + $('Title').val() + " " + $('FirstName').val() + " " + $('LastName').val() + "'"

Havnt tested this, but this should do the trick.

0
source

You should not expose SQL to the client by creating an SQL string with javascript or jQuery on the client. this task must be performed on the server side. example of SQL injection - if one input field has text, for example

a';DROP TABLE `kb_xmod_modules`; SELECT * FROM `kb_xmod_modules` WHERE 't' = 't

escaping in your input 'with ''is one way to avoid sql injection. A prepared sql statement is another solution.

You must indicate in which environment you are programming your project. What programming language?

0
source

More articles:


All Articles