Here is my ajaxForm code
var qx = $('#XText').attr('value'); $.ajax({ type: "post", url: "qsubmit.php", data: "q="+qx, success: function() { } }); And the insert code
include('db-config.php'); $q = $_POST['q']; $insert_ann = sprintf("INSERT INTO med_tab (med_title) VALUES ('$q')"); mysql_select_db($database_med_pharm, $med_pharm); $Result1 = mysql_query($insert_ann, $med_pharm) or die(mysql_error()); For some reason this is not working not sure why, any and all assistance would be great.
I want to pass in 2 values in data: "q="+qx, in the ajax js, how do I get that done.
Thanks Jean
$q = $_POST['q']; $insert_ann = sprintf("INSERT INTO med_tab (med_title) VALUES ('$q')");is the vulnerable code, you're inserting based on POST values which could easily be forged.