Question

I am running this php script from an ajax call:

<?php

    require_once('myConnectDB.inc.php');

    //add beer to database code
    $uID = $_GET['uID'];
    $uName = $_GET['uName'];
    $fID = $_GET['fID'];
    $fName = $_GET['fName'];

    //data from ajax call: "uID="+reqID+"&uName="+reqName+"&fName="+frID+"&fID="+frName,

    //add above data to database
    $db = new myConnectDB();
    error_log("Successfully created DB");                       


    error_log("uid" . $uID);    
    error_log("uName" . $uName);    
    error_log("fID" . $fID);    
    error_log("fName" . $fName);    

    $query3 = "INSERT INTO friends (userID,userName, friendID, friendName, friend) VALUES ($uID, '$uName' ,  $fID , '$fName' , 1 )";
    $result = $db->query($query3);

    error_log("Ran query [$query3] and got result: " . print_r($result, true));

    ?>

I inserted error_log to try and figure out why my query was not inserting into my database. Here is the output of my log:

[10-Sep-2012 20:36:54] Successfully created DB
[10-Sep-2012 20:36:54] uid6
[10-Sep-2012 20:36:54] uNametest
[10-Sep-2012 20:36:54] fIDmike
[10-Sep-2012 20:36:54] fName3
[10-Sep-2012 20:36:54] Ran query [INSERT INTO friends (userID,userName, friendID, friendName, friend) VALUES (6, 'test' ,  mike , '3' , 1 )] and got result: 

What I find odd here while looking at the error log is it seems some place in my php it switches the values oof fname and fID there values should be swapped.

Is this screwy or am I over looking something obviousness?

Answer 1

Look at your AJAX call:

"uID="+reqID+"&uName="+reqName+"&fName="+frID+"&fID="+frName,

this indeed does look as if fID would carry frName, while fname would carry frID!

On a side note: You surely appreciate, that a fName of something like

',1); DROP TABLE friends; -- 

would be quite funny?