0
我的最终目标是让一个js脚本以json的形式返回一个PHP查询的结果,这样我就可以用它做出恶意的事情。PHP脚本不返回查询,但MySql查询工作
我有我想要使用的MySql查询,当我在Workbench中测试它时它肯定正在工作,但是当我在PHP脚本中进行测试时,没有任何东西会返回。 PHP中的当前查询只是测试数据交换的占位符。
我手动把一些东西放到数组(searchResults)并且得到返回,但没有任何东西来自PHP脚本执行时。
我也明白这可能不是最安全或最有效的代码,我只是想在这一点上得到它的工作。
<?php
// Include your database creds and login to the db
require_once 'login_karavites.php';
$db = mysqli_connect($db_hostname, $db_username, $db_password);
// Handle the input/request.
$searchString_UNSAFE = $_POST['eName']; // change that, obviously
// Bare minimum sanitation to prevent injection.
$searchString = $db->escape_string($searchString_UNSAFE);
// Construct the SQL query
$sql = "SELECT * FROM `Halls` WHERE hall_name = 'Rose Ballroom'";
// Do the database lookup.
$result = $db->query($sql);
// Create empty array to hold our results (to be sent back to the browser).
$searchResults = array();
$searchResults[]="wow";
// If we had results, put them into that array
if ($result->num_rows > 0) {
// This loop will retrieve every row from that result set
while ($row = $result->fetch_assoc()) {
// From each row, just take the 'event_name' field.
$searchResults[] = $row['hall_name'];
}
}
// Done with the db, now we just have to send the results back to the browser.
$db->close();
// Send the correct content-type header.
// This ensures that jQuery automatically converts the response into an
// array or object, rather than just treating it like a block of text.
// Must be the FIRST thing the PHP script outputs, or it will choke.
header('Content-type: application/json');
// Output the data.
echo json_encode($searchResults);
?>
该js脚本。
$(document).ready(function() {
// All this stuff runs as soon as the page is fully loaded
// Attach a function to the Submit action on #eventForm
$('#eventForm').submit(function() {
// Submit the form via AJAX
$(this).ajaxSubmit({
// Attach a function to the "the PHP script returned some results" event
success: function(response, status, xhr, $form){
// I am assuming that this is your data format, for example:
// { "searchResults": [ "result1", "result2", "result3" ] }
// I am also assuming that you want your results in div#results
$('div#results').html(""); // Clear it out of anything that's already there.
console.log(response);
for (i in response['searchResults']) {
$('div#results').append(response['searchResults'][i]);
}
},
// Give up if PHP doesn't answer in 3 seconds
timeout: 3000,
// Path to the PHP file we want to send this to
url: 'phpdata/eventsData.php'
});
// Make sure the browser does NOT proceed to submit the form again,
// the old fashioned way (full page reload).
return false;
});
});
您是否尝试使用浏览器直接调用您的php脚本?你能看到什么吗?如果答案是'是'和'否',您是否尝试在设置标题之前转储$ searchResults的内容? –
当我尝试直接调用它时,我只能得到那一行。如果我注释掉setHeaders行,这也是同样的事情。 – Zeratas
你有一个未使用的变量'$ searchString' – sectus