We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 44437
    • 74 Posts
    Hi all,

    I was wondering if it is possible to call the snippet getImageList via AJAX. I have a page that contains hundreds of race results tables and I want to create a way for the end-user to view their desired table by using a filter provided.

    This is my filter

    <div class="list-group dropdown__list">
        <a class="list-group-item myround" href="#">Round 1</a>
        <a class="list-group-item myround" href="#">Round 2</a>
        <a class="list-group-item myround" href="#">Round 2</a>
    </div>


    I am storing the data within a MIGX tv. I have created a resource (70) with a blank template where I placed the snippet call getImageList to receive the getImageList parameters. Then I am calling that resource via AJAX.

    My AJAX call

    <script>
       $( ".myround" ).click(function() {
           
           event.preventDefault();  
                           
           $.ajax({
             type: "GET",
             url: "[[~70]]",         
             data: "&tvname=`raceresultsTV`&tpl=`tableroundsTpl`&docid=`31`&where=`{'round:=':'"+$(this).text()+"'}`",          
             success: function(html) {
             $('#selectedRound').html(html);//returns the html from the getImageList call
             }
           });
         });
    
    </script>        
    


    Resource 70 content

    [[!getImageList?]]
    


    Do I have to modify the getImageList to receive the parameters via $_GET? Or is there a better to accomplish this task?

    This question has been answered by sottwell. See the first response.

    • discuss.answer
      • 28042 ☆ A M B ☆
      • 24,524 Posts
      I would use a snippet to get the GET values, validate and sanitize them, then set them as placeholders. Put that snippet before the getImageList snippet, and use the placeholders as the values for the getImageList properties.

      Don't ever, ever let incoming GET or POST data go anywhere near your database without completely validating and sanitizing it. Remember, getImageList will be using those property values to make queries. For example, if it's supposed to be an integer value, (GET and POST are always strings) use is_numeric() to make sure it is indeed representing a number, then use type casting or intval() to convert it to a proper integer.

      A properly constructed snippet that makes database queries, like getImageList, should be using the xPDO API, which automatically escapes strings before crafting the queries, but you should still always validate and sanitize incoming values yourself before passing it on to anything that will be using it.
        Studying MODX in the desert - http://sottwell.com
        Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
        Join the Slack Community - http://modx.org
        • 44437
        • 74 Posts
        Ok, I think I get what you are saying. First time I'm hearing about validating and sanitizing GET values. I will give it a shot.

        I have tried your suggestion and wrote a simple validation snippet. I am not sure if it was written well though.

        [[!testsnippet]]

        <?php
        $result=isset($_GET['round']) ? $_GET['round'] : '';
        
        $round=preg_replace('/[^-a-zA-Z0-9_]/', '', $result); //this will take anything and make sure that it only contains letters, numbers, underscores or dashes
        
        if (is_numeric($round)) {
            $modx->setPlaceholder('round',intval($round));
        }    
        
        return;
        


        Resource 70 content

        
        [[!testsnippet]]
        
        [[!getImageList? 
            &tvname=`raceresultsTV` 
            &tpl=`resultsTpl` 
            &limit=`1` 
            &docid=`31`
            &where=`{"MIGX_id:=":[[+round]]}`
        ]]
        
        


        AJAX Call

        <script>
            $( ".myround" ).click(function() {
                            
              event.preventDefault();  
                               
              $.ajax({
                 type: "GET",
                 url: "[[~70]]",         
                 data: "&round="+$(this).text(),          
                 success: function(html) {
                 $('#results-tab').html(html);//returns the html from the getImageList 
                 //console.log(html);
                 }
               });
            });
        </script>        
        


        I haven't tested it yet due to fear of corrupting the database. Is my testsnippet is safe to use? Or do I need to sanitize the $_GET better? [ed. note: random_noob last edited this post 11 years, 4 months ago.]
          • 28042 ☆ A M B ☆
          • 24,524 Posts
          You should read up on these, then.
          http://phpsecurity.readthedocs.org/en/latest/Injection-Attacks.html
          http://phpsecurity.readthedocs.org/en/latest/Cross-Site-Scripting-%28XSS%29.html

          The is_numeric and casting to int with intval() would be sufficient, your added regular expression is also good. If you study the articles above, you'll see that it takes a deliberate attempt to submit malicious data in a form or a URL.
            Studying MODX in the desert - http://sottwell.com
            Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
            Join the Slack Community - http://modx.org
            • 4172
            • 5,888 Posts
            getImageList doesn't do a db-query with the &where.

            It does only iterate the items-array.
            So, it should be secure.
              -------------------------------

              you can buy me a beer, if you like MIGX

              http://webcmsolutions.de/migx.html

              Thanks!