I use the following code to filter data from SQL
and it works fine. However, below code is vulnerable to SQL injection, but all the $post
values are checkbox value (it's not user input). So can I use below code?
Or do I need to use "prepared statement" as per this answer? I can only send number in array.
Conn.php
try {
//create PDO connection
$conn = new PDO("mysql:host=" . DBHOST . ";port=3306;dbname=" . DBNAME, DBUSER, DBPASS);
$conn->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$conn->exec("SET CHARACTER SET utf8");
} catch (PDOException $e) {
//show error
echo '<p class="bg-danger">' . $e->getMessage() . '</p>';
exit;
}
INDEX
<div class="md-radio my-1">
<input type="radio" class="filter_all cate" name="cate" id="car" value="Car">
<label for="car">Car</label>
</div>
script
$(document).ready(function () {
filter_data();
function filter_data() {
$('.filter_data');
var action = 'fetch_data';
var cate = get_filter('cate');
$.ajax({
url: "fetch.php",
method: "POST",
data: {
action: action,
cate: cate
},
success: function (data) {
$('.filter_data').html(data);
}
});
}
function get_filter(class_name) {
var filter = [];
$('.' + class_name + ':checked').each(function () {
filter.push($(this).val());
});
return filter;
}
$('.filter_all').click(function () {
filter_data();
});
});
fetch.php
if (isset($_POST["action"])) {
$query = "SELECT * FROM allpostdata WHERE sts = '1'";
if (isset($_POST["cate"])) {
$cate = implode("','", $_POST["cate"]);
$query .= "AND sca IN('" . $cate . "')";
}
$stmt = $conn->prepare($query);
$stmt->execute();
$result = $stmt->fetchAll();
$total_row = $stmt->rowCount();
$output = '';
if ($total_row > 0) {
foreach ($result as $row) {
$output .= '<a href="/single_view.php?p=' . $row['link'] . '>' . $row['link']. '</a>
}
} else {
$output = '<h3>No Data Found</h3>';
}
echo $output;
}
array
\$\endgroup\$ – sanoj lawrence Nov 20 '19 at 14:26