I got the following code and I don't find the mistake. When i execute it, I always get "no_request".
$username is equal to Reebal and $user is equal Simon
Ajax/jQuery
$("#cancel_friend").click(function(e){
var user = "<?php echo $user_username; ?>";
var type = "cancel_friend"
$.ajax({
type: "POST",
url: "../system/friend_system.php",
data: {
user: user,
type: type
},
success: function(data, status){
if(data == "friend_request_canceled"){
$("#cancel_friend").css("display", "none");
}else{
$(".error_msg_container").html(data);
}
},
error: function(){
alert(data);
}
friend_system.php
}else if($_POST['type'] == "cancel_friend"){
$sql = "SELECT COUNT(id) friends WHERE user1 = '$username' AND user2 = '$user' AND accepted='0' LIMIT 1";
$result = mysqli_query($conn, $sql);
$request = mysqli_fetch_row($result);
if($request[0] > 0){
$sql = "DELETE FROM friends WHERE user1 = '$username' AND user2 = '$user' AND accepted='0' LIMIT 1";
$result = mysqli_query($conn, $sql);
mysqli_close($conn);
echo "friend_request_canceled";
exit();
}else{
echo "no_request";
exit();
}
Hope you can help me.
Right now on my phone so I can't look at it that well, your SQL Query is unsafe. Use either mysqli or pdo. And you forgot the FROM your the sql query, here's an sql injection safe code:
$con = new PDO("mysql:host=localhost;dbname=dbName" , "dbPassword","dbUsername"); // connecting with PDO
$query = $con->prepare("SELECT COUNT(id) FROM friends WHERE user1 = :username AND user2 = :username2 AND accepted = \"0\" LIMIT 1"); // Preparing a query
$query->bindParam(":username" , $username, PDO::PARAM_STR); // binding parameters in a safe way
$query->bindParam(":username2",$username2,PDO::PARAM_STR);
$query->execute();
$result = $query->fetchAll(); // fetching the result and putting it in result
REMEMBER TO CHANGE THE VARIABLES AND MODIFY THE CONNECTION DETAILS If it doesn't work comment not this comment