Passing Variables References to PHP from Javascript via AJAX -


i have idea "using", or "referencing" php variables in javascript. apply webpage send email. simplified example shown below. note: called via ajax, not case trying call php variable script has been executed.

the javascript include "$midsection" string in body of email sent, , send entire body php script. php script store string, create , assign value $fmidsection, , send body string in email. if works, resulting email include main body sent client side, inserted "midsection" in middle of email (perhaps, depending on person's name , info stored in database).

it seems me should work, given understanding of php. however, seems me open window attack similar sql injection (where' perhaps, can trick script assign different value $midsection, example). has taken approach, , if so, can validate whether work, , open security holes?

thank you.

edit: application mailing list, not contact form. have admin panel allows me send emails mailing list, , thinking way include variables php in similar way on php script, putting $var in string itself. understand how passing variables js php works, want js reference php variable, essentially. not using validation purposes, using easy way insert information, rather doing string parsing manually. variable created , stored server side on script have created.

also, javascript performing ajax call on php script. therefore, javascript executed first. i'm sending email template php, php loop through email list , add information dynamically, such first name, last name, etc. instead of doing string processing, i'm thinking of sending "hello, $firstname $lastname....." essentially, in hopes php script insert variable information.

from comments above can see you're trying do, won't work.

consider following code:

$(document).ready(function() {     $.ajax({         url: 'ajax.php',         data: {'name' : 'andy'},         method: "post",      }).done(function (data) {         console.log(data);     }); });

this ajax.php:

<?php echo $_post['name']; ?>

all you're doing in javascript making post request ajax.php. it's able give output "andy" in console because you're passing data string - not reference anything. far, simple.

now imagine if change data: in jquery following:

data: {'name' : '$var'}

in console string "$var".

even if had in ajax.php:

<?php $var = 'foo'; echo $_post['name']; ?>

you never output "foo".

this because php , javascript separate. if pass $var, it's going treat string. there's no way of asking javascript mean php variable or reference. have pass data itself.

in case of application, you'd typically pass in ajax request php can refer (like primary key id particular record). php generate of required content , send browser. if need things template, str_replace friend.


Comments

Post a Comment

Popular posts from this blog

android - InAppBilling registering BroadcastReceiver in AndroidManifest -

i'm implementing inapp billing in android app. works well, however, i'm trying decouple broadcast receiver activity manifest. suggestion in android's trivialdrive sample: // important: dynamically register broadcast messages updated purchases. // register receiver here instead of <receiver> in manifest // because call getpurchases() @ startup, therefore can ignore // broadcasts sent while app isn't running. // note: registering listener in activity bad idea, done here // because sample. regardless, receiver must registered after // iabhelper setup, before first call getpurchases(). currently there's class extends broadcastreceiver : public class iabbroadcastreceiver extends broadcastreceiver { /** * intent action receiver should filter for. */ public static final string action = "com.android.vending.billing.purchases_updated"; private final iabbroadcastlistener mlistener; public iabbroadcastreceiver(iabbroadcastlistener listener) { m...
Read more

python Tkinter Capturing keyboard events save as one single string -

is possible store keyboard events 1 string? code below stores 1 char , prints it. card reader or bar code reader, contains collection of character/ string not 1 character @ time. goal save char pressed text variable. from tkinter import * root = tk() def key(event): text= event.char text+= event.char print ("pressed", text) def callback(event): frame.focus_set() print ("clicked at", event.x, event.y) frame = frame(root, width=100, height=100) frame.bind("<key>", key) frame.bind("<button-1>", callback) frame.pack() root.mainloop() currently, creating text variable , everytime key() function gets called, , text stores last character typed. you can define text module level variable , , use module level text inside key function - text = '' def key(event): global text text+= event.char print("pressed", text)
Read more

sql server - Why does Linq-to-SQL add unnecessary COUNT()? -

here tables: create table customer ( cid int primary key, name varchar(32) ) create table ord ( oid int primary key, cid int foreign key references customer, address varchar(20) ) here's linq-to-sql statement: var aaa = c in db.customer select new { c, o = c.ord.tolist() }; and here's inexplicable query generated linq-to-sql: select [t0].[cid] [cid], [t0].[name] [name], [t1].[oid] [oid], [t1].[cid] [cid2], [t1].[address] [address], (select count(*) [dbo].[ord] [t2] [t2].[cid] = [t0].[cid]) [value] [dbo].[customer] [t0] left outer join [dbo].[ord] [t1] on [t1].[cid] = [t0].[cid] order [t0].[cid], [t1].[oid] i want understand how rid of count(*) part. it's entirely uncalled for! linq needs count(*) in order determine number of entries returned o = c.ord.tolist() .
Read more