Question

I have been tearing my hair with this one for a while.

index.php:

$(document).ready(function(){ 
    $(".index_login_subm").click(function(){
        uid = $("input:username").val();
        pwd = $("input:password").val();
        $.post("backend/login.php",{
            uid:uid,
            pwd:pwd
        },function(data){
            alert("Returned data: " + data);
         });
        return false;
    });
});

login.php:

include("../../settings.php");
echo $uid;
echo $_POST['uid'];

none of the echoes returns anything.

settings.php:

foreach ($_POST as $key => $value) { 
   $$key = mysql_real_escape_string($value);
}
foreach ($_GET as $key => $value) { 
   $$key = mysql_real_escape_string($value); 
}

The code works well if i comment the settings.php-include out (well, of course the echo $uid won’t work), so it must be something the mysql_real_escape_string does. Anyone have any idea what I am doing wrong?

index.php also includes settings.php if that makes any difference.

EDIT: Posts below made me want to clarify; the paths are all correct. settings.php (and some other scripts) are all put outside of the root folder to make them inaccessible to a web user. They are working well when accessed by the scripts.

Answer 1

As described in the PHP manual, mysql_real_escape_string requires a real database connection established with mysql_connect (in the second parameter). If none exists, it tries to create one by simply calling mysql_connect(). If this does not work either, it returns false.

So, you would have to create a database connection first. But before you start doing this: note it is a really really bad idea to simply take every POST and GET variable and spit it into the global namespace.