How do I pass a variable from PHP to generated JavaScript? - php

Question

I'm generating JavaScript from my PHP script, and I need to be able to copy a value directly into the generated JavaScript code.
My code is as follows:
PHP:
include "db-Info.php";
echo '<option value="">Please select item first...</option>';
$item = $_POST['itemId'];
$query = mysqli_query($con, "SELECT id, item, price, pointRequired FROM
tblprice WHERE item ='$item'");
$rowCount = $query->num_rows;
if($rowCount > 0) {
while($row = mysqli_fetch_array($query)){
$price = $row['price'];
$pointRequired = $row['pointRequired'];
echo "<option id='priceNew'>";
echo "Price : $price" ?> <?php echo "Point: $pointRequired";
echo "</option>";
}
if($item){
$price = $_POST[price];//shows undefined
$query1 = mysqli_query($con, "SELECT id FROM tblprice WHERE item
='$item'AND price ='$price'"); //it seems not picking up the same id with
the item I selected above
$rows = mysqli_fetch_array($query1);
$id = (string) reset($rows);
$barcodeNew = $id . $item;
echo $barcodeNew;
}
}
JavaScript:
$(document).ready(function() {
$('#price-select').on('change', function(){
var price = $(this).val($price); // This is where $price needs to copy
if(price){
$.ajax({
type:'POST',
url: 'functions/pos-getPrice.php',
data: {price:price},
success:function(html){
alert(price);
}
})
}
})
})//THIS CODE BLOCK IS PROBLEM
The problems are:
The line $price = $_POST[price] results an undefined value
I'm trying to copy $price into the PHP script but it's outputting $price verbatim in my script - not the value contained in $price

Answer 1

Problem 1:
You need to change $_POST[price] to $_POST['price'], like you have just above it. Without wrapping it in quotes, PHP will assume you're trying to use a constant defined with define().
Problem 2:
If you're using vanilla PHP and you want to inject a variable into a script, you'd do it like so:
var price = ($this).val(<?php echo json_encode($price); ?>);
This of course assumes that the JavaScript is being generated from the same PHP script you have above it.
You can read the documentation for json_encode here.
You have a huge security vulnerability in your code as well:
At the moment, your script is taking data in directly from the user request and putting it into an SQL query. This can lead to SQL injection attacks. Not good.
Official PHP documentation on the subject can be found here.
Recommendations:
First, I notice you're doing everything in the global space. I highly recommend that you learn how to wrap your code in classes and functions; it'll make things much easier to maintain and test.
Good things to search that will get you on the right path are:
PHP Object Oriented Programming (OOP)
PHP Standards Recommendation (PSR)
PHP Composer
Second, doing things this way is quite outmoded and makes it very easy to run into problems. I encourage you to look into more modern frameworks, such as Laravel. You might also look up single-page application (SPA) frameworks like Vue, Angular, or React, which work great with Laravel serving as a backend REST API.
Best of luck to you.