Click here to Skip to main content
15,175,960 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
I am trying to perform insert query on one table then fetch the insert id and use it for another insert query. Only my first query is executing. second one isn't. Here is my code

What I have tried:

<script>
$("#addopdfrm").submit(function(){
var opdname = $("#opdname").val();
var opdsex = $("#opdsex").val();
var opdage = $("#opdage").val();
var opdaddress = $("#opdaddress").val();
var opdcity = $("#opdcity").val();
var opdstate = $("#opdstate").val();
var opdpin = $("#opdpin").val();
var opdcon = $("#opdcon").val();
var opdmail = $("#opdmail").val();
var opdpresfee = $("#opdpresfee").val();
var odate = new Date();
var opdmonth = odate.getMonth()+1;
var opdyear = odate.getFullYear();
var opdday = odate.getDate();
var opddate = opdday+"/"+opdmonth+"/"+opdyear;
var opdtime = Date.now();
var mysql = require('mysql');
var log ="";
 insertRow(function(rows){
var mysql = require('mysql');
	  var conn = mysql.createConnection({
	  host: 'localhost',
	  user: 'root',
	  password: '',
	  database: 'plasmadoc',
	  multipleStatements: true
	  });
	  conn.connect(function(err){
    
    if(err){
        return console.log(err.stack);
    }
	 });
conn.query("INSERT INTO `opdvisits` VALUES('"+rows+"', '"+opddate+"', 'Prescription Fee', '"+opdpresfee+"', 'Waiting', 'no', '"+opdtime+"')");
alert("yay");
conn.end(function(){
                // The connection has been closed
            });
});

function insertRow(callback){
var mysql = require('mysql');
	  var connection = mysql.createConnection({
	  host: 'localhost',
	  user: 'root',
	  password: '',
	  database: 'plasmadoc',
	  multipleStatements: true
	  });
	  connection.connect(function(err){
    
    if(err){
        return console.log(err.stack);
    }
	 });
	 
	connection.query("INSERT INTO `opdrec` VALUES('', '"+opdname+"', '"+opdage+"', '"+opdsex+"', '"+opdcon+"', '"+opdaddress+"', '"+opdpin+"', '"+opdcity+"', '"+opdstate+"', '"+opdmail+"', '"+opddate+"', 'no', '"+opdtime+"')", function(err, rows) {
                if(err){
                    console.log("An error ocurred performing the query.");
                    console.log(err);
                    return;
                }
				callback(rows.insertId);
				});
	 connection.end(function(){
                // The connection has been closed
            });
  	} 

});
Posted
Updated 19-Dec-17 16:13pm
Comments
ZurdoDev 19-Dec-17 14:09pm
   
Debug your code and find out what is happening.

1 solution

JavaScript
connection.query("INSERT INTO `opdrec` VALUES('', '"+opdname+"', '"+opdage+"', '"+opdsex+"', '"+opdcon+"', '"+opdaddress+"', '"+opdpin+"', '"+opdcity+"', '"+opdstate+"', '"+opdmail+"', '"+opddate+"', 'no', '"+opdtime+"')"

Never build an SQL query by concatenating strings. Sooner or later, you will do it with user inputs, and this opens door to a vulnerability named "SQL injection", it is dangerous for your database and error prone.
A single quote in a name and your program crash. If a user input a name like "Brian O'Conner" can crash your app, it is an SQL injection vulnerability, and the crash is the least of the problems, a malicious user input and it is promoted to SQL commands with all credentials.
SQL injection - Wikipedia[^]
SQL Injection[^]
SQL Injection Attacks by Example[^]
PHP: SQL Injection - Manual[^]
SQL Injection Prevention Cheat Sheet - OWASP[^]
   

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)




CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900