http.responseText返回名为的PHP函数的名称

I am using AJAX to call a function within PHP. It returns my data fine but, it keeps putting the function name at the beginning of the returnText.

My Javascript/ajax

function getfirst() {
    var myphp=document.getElementById('myphp').value ;
    http=createRequestObject();
    url= tablename + '.php?filename=' + tablename;
    url= url + '&function=movefirst';
    url= url + '&seekindex=CustomerKey';
    url= url + '&maxdata=' + maxdata;
    http.open('GET',url,false);
    http.send(null);
    document.getElementById('myreturn').value;
}

MY PHP

<?php include '../../tophat.php';

$_REQUEST['function']();

function movefirst(){
    $filename=$_REQUEST['filename'];
    $seekindex=$_REQUEST['seekindex'];
    $maxdata=$_REQUEST['maxdata'];
    opendbdata();
    $query="SELECT * FROM ". $filename . " ORDER BY " . $seekindex; 
    $result=mysql_query($query);
    $returnkey='';
    for ($i=0; $i<=$maxdata-1; $i++)  {
         $returnkey = $returnkey . mysql_result($result,0,$i) . "~";
    }
    echo $returnkey;
}

I'm looking up the first customer in my customer database it returns the record but at the beginning of the returnText is the name of the function. Here is the beginning of the .returnText: "movefirst4SEASONS1~4 Seasons Pottery~336 Hammond Dr NE~"

I have never had this problem before. Thanks in advance for your help.

Note that you

• allow users to execute any functions that are available in this scope (something like dropDatabase() or rebootServer()) since you're invoking $_REQUEST['function']
• allow users to make any changes in your database or read secret information by taking advantage of SQL Injection!

I suspect there's some debug code left in tophat.php. Try placing a die() just after the include and see whether the new responseText holds ONLY the function name.

That said, I concur and upvote Steffen's answer -- a syntax like

$_REQUEST['function']();

looks like a disaster waiting to happen. Even if it is not, it still LOOKS like it is, which is bad anyway.