Question

The following code is part of my ajax notification system and for some reason, it is working only 50%. When I call the code, it runs and then echo’s either success or remove but it doesn’t seem to change the database values. Any reason? I have tried putting my column names in quotes but that echo’s an error. Please help, thanks!

<?php
require_once('.conf.php');
$notid = mysql_real_escape_string($_GET['notification_id']);
$username = mysql_real_escape_string($_SESSION['uname']);
$action = mysql_real_escape_string($_GET['action']);

if ($action == 'add') {
    $insert = mysql_query("UPDATE updates SET object_fav = '1' WHERE username = '$username' AND id = '$notid'") or die('Could not connect: ' . mysql_error());
    echo 'success';
} elseif($action == 'sub') {
    $remove = mysql_query("UPDATE updates SET object_fav = '0' WHERE username = '$username' AND id = '$notid'") or die('Could not connect: ' . mysql_error());
    echo 'remove';
} else {
    echo 'error';
}
?>

---

I know it is not the javascript, I have checked the network tab and it is sending the correct values.

Answer 1

If this is the start of the script, you have not called session_start(), and therefore $_SESSION['uname'] will contain an empty value. The query succeeds because it is syntactically correct, but doesn’t match any rows and therefore performs no update.

session_start();
require_once('.conf.php');
$notid = mysql_real_escape_string($_GET['notification_id']);
$username = mysql_real_escape_string($_SESSION['uname']);
$action = mysql_real_escape_string($_GET['action']);