Question

I have several questions involving the interaction between JavaScript and MySQL.

The basic idea of what I am trying to accomplish is to use JavaScript to allow admins to change the content of certain elements. These elements contain text and by clicking on the element, using JavaScript, a “pop-up” textarea with the old text should appear and allow the admin to modify the text. After the admin modifies the text he can then post it modifying data in the MySQL table.

I understand that the basic flow of this action will be:
javascript -> AJAX request -> script running on the server (PHP, Perl, ASP.NET, whatever) -> database

1. Can some one give me a very basic demo of how to perform something like this?
2. Is this unsafe?
3. Is this the best approach for what I am trying to accomplish?

Answer 1

This is pretty common way to provide users with a quick way to edit something.
You are on right track. Use a popup to display the form, send an AJAX request to call a server script when user submits the form.

For example, if you are using jqueryUI, this becomes pretty easy:

• Refer http://jqueryui.com/demos/dialog/#modal-form to see how you can create popup forms using jqueryUI
• Once a user submits the form, you need to POST it to a server script that receives the data and updates the database (as you’d normally do). Make it send a SUCCESS/FAIL value so that the client can know if the operation succeeded.
• Dismiss the popup if the update was successful or display the error if it was not.

Is this unsafe?

This isn’t unsafe. The only thing to remember is that you need to check that the user is authenticated (i.e. in session) in the server script(which updates the records) that is called via ajax . Forgetting that will make anyone call your server script to edit records. This is pretty obvious but I’ve seen so many people miss this when it comes to AJAX requests. If the operation you are doing doesn’t require authentication then obviously this isn’t a problem.