Plugin AJAX Save to Custom Table

Question

I am learning how to use AJAX in the admin for a new plugin I am writing. In the PHP I have the function:

function ppmhnh_add_location(){
    global $wpdb;
    $values = array();
    parse_str($_POST['form'], $values);
    $sql = "INSERT INTO ppm_hoopsandhits_locations VALUES ('{$values['locale']}', '{$values['locale_city']}', '{$values['locale_state']}')";
    $wpdb->query($sql); 
    echo "Added successfully!";
    die();
}
add_action('wp_ajax_ppmhnh_new_location','ppmhnh_add_location');

The javascript uses this:

$('#newLocation').submit(function(e){
        $('#wait-gif').show();
        $('#btnAddLocation').attr('disabled', true);
        data = {
            action: 'ppmhnh_new_location',
            form: $(this).serialize()
        };

        $.post( ajaxurl, data, function(response){
            alert(response);
            $('#wait-gif').hide();
            $('#btnAddLocation').attr('disabled', false);
            location.reload();
        });
        return false;
    });

If I echo $sql in response, I get the correct SQL statement

INSERT INTO ppm_hoopsandhits_locations VALUES ('100 Midtown', 'Atlanta', 'GA')

However nothing is being added to the table.

Also, I would prefer just to refresh the part of the admin page where the table is displaying all of the values of the table rather than the whole page but I haven't figured that out yet.

Any help is appreciated!

Answer 1

Please use the available API - as you have it in your question I could take down your entire site in a second. (I wrote this tutorial on Data Sanitization and Validation - the last section is particular relevant to you).

As for it not inserting the data, you should check WP_DEBUG is turned on, and also print what $wpdb->query( $sql ) responds. But in any case, its much better (safter & neater) to do the following:

$wpdb->insert(  
    'ppm_hoopsandhits_locations', 
    array( 
      'locale' => $values['locale'], 
      'locale_city' => $values['locale_city']
      'locale_state' => $values['locale_state']
    ), 
    array( '%s', '%s', '%s' )  
); 

where the 'locale', 'locale_city', etc are the name of the columns.

Also if this is for public release you should prefix your table name with $wpdb->prefix so that there aren't problems when multiple wordpress installs are present in the same database.