security issues with Ajax

Hi,

Im curious if there is major issues with security when using Ajax to grab and process php scripts.
currently i use a function to grab data and replace content like so

//GRAB PHP INFO
function ajax_update_status(value){
	   // Get all the form data 
	   $.ajax({
         type: "POST",
         url: "ajax/online_status.php?s=" + value
		 
    	});
	 
}
	 

Select all Open in new window

i then use the following command to execute the function

onclick="ajax_update_status('invisible'); return false" data-status="status-invisible"

Select all Open in new window

the online users php script requested is as follows

//GET THE USERS CURRENT ONLINE SESSION STATUS AND CHANGE IT IF NESSECARY

if(isset($_GET['s']) && !empty($_GET['s'])){
	
	//THE VARIABLE IS SET
	if($_GET['s'] == 'online'){
		//SET THE SESSION VARIABLE TO ONLINE
		$_SESSION["online_status"] ='online';
		
		//CHANGE THE USERS DATABASE ENTRY
		online_status($_SESSION["uid"], 'online', $datetime);
		
	}elseif($_GET['s'] == 'away'){
		//SET THE SESSION VARIABLE TO AWAY
		$_SESSION["online_status"] = 'away';
		
		//CHANGE THE USERS DATABASE ENTRY
		online_status($_SESSION["uid"], 'away', $datetime);
		
	}elseif($_GET['s'] == 'invisible'){ 
		//SET THE SESSION VARIABLE TO INVISIBLE
		$_SESSION["online_status"] = 'invisible';
		
		//CHANGE THE USERS DATABASE ENTRY
		online_status($_SESSION["uid"], 'invisible', $datetime);
		
	}
}

the function of  online status is 

[code]//CHANGE THE USERS DATABASE ONLINE STATUS WHEN THE USER LOGS ON
function online_status($uid, $status, $date){
	global $link;
	$date_clean =mysqli_real_escape_string($link,str_replace(",","-",$date));
	if($status==="online" || $status==="away" || $status==="invisible" || $status==="offline"){
		$sql=" UPDATE bb_users SET online_status='".$status."', online_status_time='".$date_clean."' WHERE uid='".$uid."' LIMIT 1";	
		mysqli_query($link, $sql) or die;
	}
}

Select all Open in new window

i was worried about SQL injection in the function from the date variable and the status variable. im not sure if i need to worry about the uid var as it is a session variable which i have set upon logon. am i going about this the right way? what could i do to make this more secure. i really do not want to have SQL injection or any massive holes.

thanks in advance