delete.php and linking

[illuz1on]

<?php

 

require_once("db.php");

 

$sql = "DELETE FROM news WHERE id='$id'";

mysql_query($sql);

echo "Success!!";

 

?>

 

Hey, that is my delete.php file. This is the link I use to try make it delete..

 

<a href=\"delete.php?id=$id\">Delete</a>

 

It says "Success!!" but then doesnt remove anything from the database?

 

Can anyone help me try see why it doesnt?

 

Thanks

[ShogunWarrior]

When you are getting something from a URL you get it by name like so:

$id = $_GET['id'];

 

or if the URL was ?name=value

$var = $_GET['name'];

 

Have a look at the PHP manual about the get and post superglobals, very useful for most projects.

[Eugene]

Is $id defined. you should try $_GET['id'], although that will pose some security problems.

[illuz1on]

mmm ok i see ... so it should look like this then?

 

<?php

require_once("db.php");

$sql = "DELETE FROM news WHERE id='$_GET['id']'";
mysql_query($sql);
echo "Success!!";

?>

[ShogunWarrior]

I would take the $_GEt part out of the SQL for clarity.

 

<?php

require_once("db.php");

$id = mysql_escape_string( $_GET['id'] );
$sql = "DELETE FROM news WHERE id='$id'";
mysql_query($sql);
echo "Success!!";

?>

[boo_lolly]

i wouldn't recommend using a $_GET variable as part of your delete query. if you do, anybody can delete anything if they wanted to.

[ShogunWarrior]

As they could with a $_POST,$_REQUEST or AJAX request, it is up to him to implement security.

[boo_lolly]

As they could with a $_POST,$_REQUEST or AJAX request, it is up to him to implement security.

 

that was my point... to sanitize user input.

[ShogunWarrior]

Ah, very good. Go team!