PHP/Ajax/jQuery - Passing a jquery value to a php script

Question

I have a bookings.php page which has a jqgrid that displays all the bookings that have been made online. When you double click a row, this opens a jq dialog that displays all the details about there booking. Also, when you double click, I have a variable defined which is the booking reference which I want to pass to a php script:

var brData = rowData['bookref'];

I am sending this variable via ajax:

function getGridRow(brData) {

   $.ajax({

    // Request sent from control panel, so send to cp.request.php (which is the handler)
    url: 'scripts/php/bootstrp/all.request.php',
    type: 'GET',

    // Build data array - look at the '$_REQUEST' parameters in the 'insert' function
    data: {


        //ft: "getDGRow",
        rowdata: 'fnme=getDGRow&row_data='+brData,
        data: brData,

        // Either pass a row id as the 'id' OR a where clause as the 'condition' never both
        id: null,
        condition: null
    },
    dataType: 'text',
    timeout: 20000,
    error: function(){
        alert("It failed");
        $('#cp-div-error').html('');
        $('#cp-div-error').append('<p>There was an error inserting the data, please try again later.</p>');
        $('#cp-div-error').dialog('open');
    },
    success: function(response){

        // Refresh page

       // response = brData;
       // alert(response);

    }
});


}

Here is the switch case for all.inc.php:

case 'getDGRow':
//header('Content-type: text/xml');
DatagridController::getGridRow($_REQUEST['rowdata']);
break;

This is the PHP function that I am sending the jquery variable to, to use within my PHP code:

public static function getGridRow($rowdata) {

    $rowdata = $_GET['data'];
    echo $rowdata;

    $pdo = new SQL();
    $dbh = $pdo->connect(Database::$serverIP, Database::$serverPort, Database::$dbName, Database::$user, Database::$pass);

    try {

        $query = ("SELECT * FROM tblbookings WHERE bookref = '$rowdata'");

        $stmt = $dbh->prepare($query);

        $stmt->execute();

        $row = $stmt->fetch(PDO::FETCH_BOTH);

        BookingDocket::set_id($row['id']);
        BookingDocket::set_bookref($row['bookref']);
        BookingDocket::set_bookdate($row['bookingdate']);
        BookingDocket::set_returndate($row['returndate']);
        BookingDocket::set_journeytype($row['journeytype']);
        BookingDocket::set_passtel($row['passengertel']);
        BookingDocket::set_returndate($row['returndate']);



        $stmt->closeCursor();

    }

    catch (PDOException $pe) {
        die("Error: " .$pe->getMessage(). " Query: ".$stmt->queryString);
    }

    $dbh = null;

}


}

I have put echo $rowdata; in the PHP function to see if the variable is being passed which it is as I can see 'BR12345' in the firebug console. The problem is that this query:

 $query = ("SELECT * FROM tblbookings WHERE bookref = '$rowdata'");

is not fetching any results. If I was to put:

 $query = ("SELECT * FROM tblbookings WHERE bookref = 'BR12345'");

it does fetch the results that I need so I can't understand why this query isn't working when the variable brData is being passed to $rowdata

Any suggestions?

Answer 1

Wondering why you have a prepared statement in your code but not actually using it properly.

$stmt = $dbh->prepare("SELECT * FROM tblbookings WHERE bookref = :data");
$stmt->execute(array(
    ':date' => trim($rowdata),
));

I've added trim() to make sure there are no spaces or newlines around it that could mess things up.

Update

It's debug time:

public static function getGridRow($rowdata) {

    $rowdata = $_GET['data'];
    echo $rowdata;

Add the following lines:

    echo "=====DEBUG====== ";
    var_dump($rowdata); 
    echo " =====DEBUG====== ";
    exit;

This will write the value and immediately stop your script so you can inspect its value in detail.

Answer 2

Use functions

HtmlSpecialChar() 
Trim()

then display $rowdata variable and if string is in correct format then

try this

 $query = ("SELECT * FROM tblbookings WHERE bookref = '$rowdata'");

or

 $query = ("SELECT * FROM tblbookings WHERE bookref = '".$rowdata."'");

PHP can see variable without -> '