Delete Statment

[Cooper94]

<?php include 'includes/session.php'; include 'data.php'; ?>
<center><font color="red">
<?php if(isset($_POST['submit'])) { 
$flightnumber=$_POST['flightnumber']; 
$dep=$_POST['dep'];
$arr=$_POST['arr'];
$comments=$_POST['comments'];
$aircraft=$_POST['aircraft'];
$online=$_POST['online'];
$dur=$_POST['dur'];
$deptime=$_POST['deptime'];
$arrtime=$_POST['arrtime'];

$flightnumber = stripslashes($flightnumber);
$flightnumber = mysql_real_escape_string($flightnumber);
$dep = stripslashes($dep);
$dep = mysql_real_escape_string($dep);
$arr = stripslashes($arr);
$arr = mysql_real_escape_string($arr);
$comments = stripslashes($comments);
$comments = mysql_real_escape_string($comments);
$aircraft = stripslashes($aircraft);
$aircraft = mysql_escape_string($aircraft);
$online = stripslashes($online);
$online = mysql_escape_string($online);
$dur = stripslashes($dur);
$dur = mysql_escape_string($dur);
$deptime = stripslashes($deptime);
$deptime = mysql_escape_string($deptime);
$arrtime = stripslashes($arrtime);
$arrtime = mysql_escape_string($arrtime);
$today = date("Y-m-d");

if ($flightnumber=="RPA"){
  echo "Invalid Flight Number"; 
}

else{
echo "Report Filled";
mysql_query("DELETE FROM book WHERE flightnum='$flightnumber' and username='{$_SESSION['username']}'");
$sql=mysql_query("INSERT INTO pendingrep (flightnum,dep,arr,comments,aircraft,online,duration,deptime,arrtime,date,callsign)
VALUES
('$flightnumber','$dep','$arr','$comments','$aircraft','$online','$dur','$deptime','$arrtime','$today','{$_SESSION['username']}')");
}
}
?>

I have all the other codeing such as session_start ect. But when I press submit it will delete all the flights under that flight number. So I made it go by username and when I do it, it still deletes all of the flights.

[unrelenting]

I'd change that -- and username='{$_SESSION['username']}' --

 

Try setting a variable for it. I'm not sure that that is formatted right.

 

Also, try echoing it out to see what the variable holds.

[Q695]

try this

<?php
$sql="DELETE FROM book WHERE flightnum=/'$flightnumber/' and username='mysql_real_escape_string($_SESSION[/'username/'])'";
?>

run $sql on the next line.