Making a Like/Dislike AJAX script - Not working

Question

I'm just building the like side of it first. Basically, I just want it to automatically run an external PHP/MySQL script that adds a +1 to the "rating" column for what was liked. I want this to happen without reloading the page, hence AJAX. I've never used AJAX and I'm having some trouble getting it to work. Below is the relevant code and I put a link to where I'm working on it at at the bottom of this post.

Here's the form to start:

<div id="voting">    
<form>   
  <input name="vote" type='button' onclick="getVote(<?php echo $image['filename'];?>)" value='Like' /> 
    </form>
</div>

Here's the AJAX part of it:

<script type="text/javascript">
function getVote(filename)
{
if (window.XMLHttpRequest)
  {// code for IE7+, Firefox, Chrome, Opera, Safari
  xmlhttp=new XMLHttpRequest();
  }
else
  {// code for IE6, IE5
  xmlhttp=new ActiveXObject("Microsoft.XMLHTTP");
  }
xmlhttp.onreadystatechange=function()
  {
  if (xmlhttp.readyState==4 && xmlhttp.status==200)
    {
    document.getElementById("voting").innerHTML=xmlhttp.responseText;
    }
  }
xmlhttp.open("GET","voting.php"+filename,true);
xmlhttp.send();
}
</script>

And finally, the voting.php script that's supposed to run:

<?php
//Database Information
$dbhost = "";
$dbname = "";
$dbuser = "";
$dbpass = "";

//Connect to database
mysql_connect ( $dbhost, $dbuser, $dbpass)or die("Could not connect: ".mysql_error());
mysql_select_db($dbname) or die(mysql_error());

$filename = $_GET['filename'];

$query = "UPDATE images SET rating = rating+1 WHERE filename = '$filename'";

mysql_query($query) or die(mysql_error());
mysql_close();

?> 

Here's the site it's supposed to go on if it's of any help to anyone. I'd really appreciate any kind of help. Absolutely clueless and I've never used AJAX before. Thanks in advance!

Answer 1

I don't know if this is your problem, but you aren't sending any parameter to the voting url.

xmlhttp.open("GET","voting.php?filename="+filename,true);

Also, you would like to protect that script for simple forms of sql injection.

$filename = isset($_GET['filename']) ? mysql_real_escape_string($_GET['filename']) : null ;

if (is_null($filename)) {
    exit;
}