parser error from json & jquery

I am writing a simple update php script.
But the json is not working for the update.php. I am not familiar with json, can anyone help me on the json below?

$items = rtrim($_POST['items'],",");
$sql = "UPDATE service_table SET granted='1' WHERE id IN ($items)";

$total = count(explode(",",$items)); 
$result = runSQL($sql);
$total = mysql_affected_rows(); 


header("Expires: Mon, 26 Jul 1997 05:00:00 GMT" );
header("Last-Modified: " . gmdate( "D, d M Y H:i:s" ) . "GMT" );
header("Cache-Control: no-cache, must-revalidate" );
header("Pragma: no-cache" );
header("Content-type: text/x-json");

$json = "";
$json .= "{\n";
$json .= "query: '".$sql."',\n";
$json .= "total: $total\n";
$json .= "}\n";
echo $json;
?> 

I do not receive the json success alert box such as this.
query: ‘UPDATE service_table SET granted=‘1’ WHERE id IN 1’,
total: 3,

first method, I try adding the error in ajax, and it prints out ParserError

error: function(XMLHttpRequest, textStatus, errorThrown)
{
     alert(textStatus + " | " + errorThrown);     // throw ParserError
} 

my second method, I use json_encode but it throw $sql and $total as undefined.

$json = "";
$json .= "{\n";
$json .= "query: '".$sql."',\n";
$json .= "total: $total\n";
$json .= "}\n";
echo json_encode($json); 

anyone has any idea of this?

Replies(2)

dave.meth..

Re: parser error from json & jquery

12 years ago

$items = rtrim($_POST['items'],","); $sql = "UPDATE service_table SET granted='1' WHERE id IN ($items)";

Code like this is an opportunity for SQL injection:
http://st-curriculum.oracle.com/tutorial/SQLInjection/index.htm

Consider if an attacker posts a value for items that looks like this:

0) or (1=1

Now your service_table has granted='1' for all values. They can do worse things to the db, of course.

Never, never, NEVER trust data sent by the client. At minimum, if you expect a series of numbers separated by commas, make sure the input is a series of numbers separated by commas.

Response title

Attachments

jQuery Forum