If this is your real server side code then...its completely insecure. You should never pass variables posted by users directly into your queries.
$query2 = "insert into booking(cust_email, cust_mobile, cust_name) values('$mail','$mobile','$name')";
At least escape the values using "mysql_real_escape_string", or use prepared statements. And...dont use mysql anymore, use mysqli, which is almost identical to what you are using, but not deprecated soon.
Also, you are json encoding a string that doesnt need to be json encoded, its just a piece of text and not valid json code. This may be why @SimarjeetSingh Panghlia answer doesnt work for you.
instead of json_encoding that value, encode a structured array.
$response = array( "status" => true );
if(isset($_POST['type']))
{
if($_POST['type']=="booking"){
$name = mysql_real_escape_string( $_POST ['Name'] ));
$mobile = mysql_real_escape_string($_POST ['Mob_Num']);
$mail = mysql_real_escape_string($_POST ['Email']);
$query1 = "insert into customer(userName, userContactNumber, email) values('$name','$mobile','$mail')";
$query2 = "insert into booking(cust_email, cust_mobile, cust_name) values('$mail','$mobile','$name')";
$result1 = mysql_query($query1);
$result2 = mysql_query($query2);
$id = mysql_insert_id();
$response["message"] = "Welcome Mr/Mrs ".$name." Thanks for booking home services your booking id is = ".$id;/* make sure you strip tags etc to prevent xss attack */
}
}
else{
$response["status"] = false;
$response["message"] = "Invalid format";
}
echo json_encode($response);
/* Note that you are making the query using ContentType:"application/json", */
which means you should respond using json regardless if query is successful or not. I would also recommend using a simple jQuery plugin called jStorage, that allows easy get/set of objects without having to serialize them.
Answer from Rainer Plumer on Stack OverflowIf this is your real server side code then...its completely insecure. You should never pass variables posted by users directly into your queries.
$query2 = "insert into booking(cust_email, cust_mobile, cust_name) values('$mail','$mobile','$name')";
At least escape the values using "mysql_real_escape_string", or use prepared statements. And...dont use mysql anymore, use mysqli, which is almost identical to what you are using, but not deprecated soon.
Also, you are json encoding a string that doesnt need to be json encoded, its just a piece of text and not valid json code. This may be why @SimarjeetSingh Panghlia answer doesnt work for you.
instead of json_encoding that value, encode a structured array.
$response = array( "status" => true );
if(isset($_POST['type']))
{
if($_POST['type']=="booking"){
$name = mysql_real_escape_string( $_POST ['Name'] ));
$mobile = mysql_real_escape_string($_POST ['Mob_Num']);
$mail = mysql_real_escape_string($_POST ['Email']);
$query1 = "insert into customer(userName, userContactNumber, email) values('$name','$mobile','$mail')";
$query2 = "insert into booking(cust_email, cust_mobile, cust_name) values('$mail','$mobile','$name')";
$result1 = mysql_query($query1);
$result2 = mysql_query($query2);
$id = mysql_insert_id();
$response["message"] = "Welcome Mr/Mrs ".$name." Thanks for booking home services your booking id is = ".$id;/* make sure you strip tags etc to prevent xss attack */
}
}
else{
$response["status"] = false;
$response["message"] = "Invalid format";
}
echo json_encode($response);
/* Note that you are making the query using ContentType:"application/json", */
which means you should respond using json regardless if query is successful or not. I would also recommend using a simple jQuery plugin called jStorage, that allows easy get/set of objects without having to serialize them.
You can use sessionStorage to store and retrieve JSON Data.
var complexdata = [1, 2, 3, 4, 5, 6];
// store array data to the session storage
sessionStorage.setItem("list_data_key", JSON.stringify(complexdata));
//Use JSON to retrieve the stored data and convert it
var storedData = sessionStorage.getItem("complexdata");
if (storedData) {
complexdata = JSON.parse(storedData);
}
To remove sessionStorage Datas after using use sessionStorage.clear();
EDIT
var options = {foo:'foo'};
var myURL="http://localhost";
window.open( myURL + "/?options=" + JSON.stringify(options) );
didn't test that code before, try this, you can access it through GET
I see there are several ways to do this:
- Cookies. Write values to cookies and read it in the opened window.
- Pass as a part of url hash: window.open(url + '#' + encodeURIComponent(JSON.stringify(json));
I would try to
winRef = window.open(...);
winRef.postMessage(...);
https://developer.mozilla.org/en/DOM/window.postMessage
I didn't try the third option, but it might be a nice alternative to 1 and 2.
If the two pages are on the same domain, a third way is to use HTML5 localStorage: http://diveintohtml5.info/storage.html
In fact localStorage is precisely intended for what you want. Dealing with GET params or window/document JS references is not very portable (even if, I know, all browsers do not support localStorage).
Here's some very simple pure JavaScript (no HTML, no jQuery) that converts an object to JSON and submits it to another page:
/*
submit JSON as 'post' to a new page
Parameters:
path (URL) path to the new page
data (obj) object to be converted to JSON and passed
postName (str) name of the POST parameter to send the JSON
*/
function submitJSON( path, data, postName ) {
// convert data to JSON
var dataJSON = JSON.stringify(data);
// create the form
var form = document.createElement('form');
form.setAttribute('method', 'post');
form.setAttribute('action', path);
// create hidden input containing JSON and add to form
var hiddenField = document.createElement("input");
hiddenField.setAttribute("type", "hidden");
hiddenField.setAttribute("name", postName);
hiddenField.setAttribute("value", dataJSON);
form.appendChild(hiddenField);
// add form to body and submit
document.body.appendChild(form);
form.submit();
}
Use some PHP like this on the target page to get the JSON:
$postVarsJSON = $_POST['myPostName'];
$postVars = json_decode( $postVarsJSON );
Or, more simply for JavaScript:
var postVars = JSON.parse( <?php $_POST['myPostName']; ?> );