Bdtjtk

I'm trying to insert into my table in database. I'm doing it with ajax.

Here is my code:

$(document).on('click','.add', function(){

    var id = $(this).attr("id");

    var DT = $('#DT'+id).val(); 

    var SV = $('.search_text').val(); // store input value

    var action = "add";





    $.ajax({



        url:"action.php",

        method:"POST",

        data:{DT:DT, SV:SV,action:action,id:id},

        success: function(data){



            alert("success");               



        },

        error: function(){



        alert("error action");



        }



    });



});

Data will point to action.php. Here is the code of action.php:

if (isset($_POST['action'])) {



        if($_POST["action"] == "add") {





            $insert_dtb = mysqli_query($con, "INSERT INTO table_dtb(SV, DT, DK, NH, ttDK, ngTT) 

            value($_POST[SV],$_POST[DT],now(),$_POST[SV],'1',now());"); 





        }

}

But my input value in SV variable become number when insert to table.

Example: if I enter 0153222, then in column SV of table table_dtb it only be 153222 and I can't input character into the column SV.

Although I set column SV in table_dtb is varchar(9), It's not working as I expected.

You're passing the value of $_POST[SV] twice when presumably it should be whatever value you wanted for NH. Still, not only would you have caught this using prepared statements, but you're just setting yourself up for SQL injection with your current code.

Take a look at this example:

<?php

try {

  /* setup your database configuration */

  $config =  array(

    "host" => "127.0.0.1",

    "username" => "root",

    "password" => "",

    "name" => "db_name"

  );

  $dsn = "mysql:dbname=$config[name];host=$config[host];charset=utf8mb4";

  $db = new PDO($dsn, $config["username"], $config["password"]);

  $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

  $db->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);



  /* prepare the SQL statement */

  $stmt = $db->prepare("

    INSERT INTO `table_dtb` (

      `SV`, `DT`, `DK`, `NH`, `ttDK`, `ngTT`

    ) VALUES (

      :sv, :dt, NOW(), :nh, '1', NOW()

    );

  ");



  /* execute the statement passing the parameterized values */

  $stmt->execute(array(

    ":sv" => $_POST["SV"],

    ":dt" => $_POST["DT"],

    ":nh" => $_POST["NH"]

  ));

} catch(PDOException $ex) {

  /* pdo exception */

} catch (Exception $e) {

  /* php exception */

}

?>

To explain what the code does, you can break it down into 4 distinct sections. The first section is the Try/Catch exception handler. Anytime that you have a piece of code that has the ability to fail you should wrap it in Try/Catch handlers, what this does is say "I will try to execute this code, but if it fails then I want to take care of the error that ensues." The reason there are two separate catch blocks is that you have one to take care of database errors and another to take care of your normal PHP errors. If all you wanted to do with errors is tell the user that an error happened, simply use an echo statement. However, if you are debugging and the error message is relevant then you can get the execption's message by calling the getMessage function.

The second section is the database configuration. Starting in PHP 5, PHP Data Objects are used to handle your database operations. The reason I personally setup a configuration array is because to me it is simpler to debug and read, though it is not entirely necessary. The important part is that you create a new PDO object.

The third section is preparing the SQL statement using parameterized values. Because whitespace is ignored in SQL statements and PHP allows for line continuations in String literals, you are able to format your SQL statement for better readability by using separate lines for different segments of your SQL statement. The basic idea of the values that have the : prefix before them is that they represent a value not stored directly in the SQL String.

The fourth section is executing the parameterized query. Calling the execute function on its own would run the SQL statement, but because you've passed parameters in the SQL query you also need to pass the values that are to be sent. In this case we have named parameters, so in an associative array we specify the name of the parameter as the key and then assign the value to be passed as the value.

Hopefully this clears up the code for you and if you have any questions feel free to ask.