Question

Following snippet should be collecting data and sending it to a php file.
It does output proper values on click of the button.

var dataString = 'username='+SessionVars.my_username+'&lessonid='+SessionVars.my_lesson_number;
$('#tracking_submit').click(function(){
$.ajax({
    url: "php/tracking.php",
    type:'POST',
    data: dataString,
    success: function(){
    $('#tracking_message').replaceWith(SessionVars.my_username+"Thank you for updating."+SessionVars.my_lesson_number);
    }                   
    });
return false;   
});

Then the php file portion i’m using is this:

session_start(); 
mysql_connect("stuff i tested and it works");
mysql_select_db("same");

$username=$_POST['username'];
$lessonid=$_POST['lessonid'];

mysql_query("INSERT INTO tracking ( username, lessonid ) VALUES ( ".$username.", ".$lessonid." );");

When I check the database, there is nothing in it.

Answer 1

This cannot work, since you’re not putting values in your query into quotes. This should help and prevent you being hacked as well:

mysql_query("INSERT INTO tracking ( username, lessonid ) VALUES ( '".mysql_real_escape_string($username)."', '".mysql_real_escape_string($lessonid)."' )");