[php] Deleting row based on ID

[gtg93]

Hi All,

 

I'm dabbling with PHP, and am currently trying to put an inventory together. It's not going to be used properly by anyone, it's just more a way of me learning something new at the moment.

 

I've got the basics working at stockintest.tonerinventory.co.uk - you can view the DB and add items (it's not very pretty at the moment). I've added a delete link, but as you'll see it doesn't work, and I was hoping someone could offer some advice as to why:

 

The delete link I have looks like this:

id;?>" onclick="javascript: return confirm('Are you SURE you wish to do this?');">Delete ; ?>

 

and delete.php looks like:

require "config/db.php";


mysql_connect($host,$username,$password);


@mysql_select_db($database) or die( "Unable to select database");
$query="SELECT * FROM stafflaptops";


$result=mysql_query($query);
$num=mysql_numrows($result);


mysql_query("DELETE FROM stafflaptops WHERE ID='$id'"); 


header("Location: ../view.php"); 

mysql_close(); ?>

 

I know the delete.php works, because if I replcae $id with the value from the DB it does delete the row... I'm assuming the issue is in "<?php echo $row->id;?>" but I'm at a complete loss.

 

I'm mainly following tutorials online and going through sites like stackoverflow to fix issues I come across, but am lost with this one.

 

Any helps appreciated.

 

Cheers

[zag]

Does the URL work? What link does the URL go to?

 

It should be easy to check if the link you are going to has the ID in it.

 

id;?>

 

Here is a snipit from one of my sites that works

 

echo "
/images/icons/remove.png Remove Album
";

 

And the javascript function

 

// Are you sure function
function makesure() {
	if (confirm('Are you sure?')) {
		return true;
	}
	else {
		return false;
		}
	}

Edited September 7, 2015 by zag

[gtg93]

If I remove the fowarder back to the page (header("Location: ../view.php"); ) - the link it takes me to is... http://stockintest.tonerinventory.co.uk/delete.php - so it appears to not be detecting the ID...

 

In your example - what does the "&d=9&a=" mean?

[LosOjos]

You have an extra quote in this line (you only need one after the PHP echo. Also, you need a question mark following the page name - this acts as a separator so that the server can distinguish the page request (delete.php) from the query string (id=xx) (for future reference, to pass multiple parameters you separate them with an ampersand [&]):

 

id;?>[b]"[/b] onclick="javascript: return confirm('Are you SURE you wish to do this?');">Delete ; ?>

 

However, your PHP is not populating the page with the id - could you share the code for view.php? Obviously, remove any login details! (though it looks like you've already put them in a separate file, which is good!)

[zag]

The URL should be something like this:

 

http://stockintest.tonerinventory.co.uk/delete.php?id=19

 

Be aware though that this is very insecure, as anyone could visit that URL.

[webman]

To build upon what zag has said (and he is right!), actions like this shouldn't really be plain links. URLs that change things (like adding, updating and deleting) should generally be accessed via POST (instead of GET).

 

It would be easy enough to create a form to replace the delete link in each row, like this:

 

</pre><form action="delete.php" method="post" onsubmit="javascript:return confirm('Are you SURE you wish to do this?');">


<

 

In delete.php, you can get the ID like this:

 

$id = (int) $_POST['id'];

[LosOjos]

Adding to @zag and @webman's comments, it's also a very good idea to have some form of user auth if you're going to allow edits to the DB. POST data is somewhat hidden from the standard user, but anyone who wanted to cause you havoc could very easily edit the request headers to your delete.php page to remove whatever they liked. At least if they had to login first, you'd add an extra level of security!

[ThePurpleK]

By the way, have you considered learning PHP via a more practical route? PHP has advanced so much in the past few years, that I'd actually recommend you skip learning plain PHP (which causes you to easily pick up bad coding practices and implement poor security) and learn Laravel instead. It's very beginner friendly, and if you have learnt enough to understand PHP's syntax, Laravel will be a godsend to you.

 

I heavily recommend Team Treehouse for learning PHP (or any programming language/framework, for that matter) and Laracasts for Laravel (Jeffrey Way can teach anybody just about anything in his videos!).

[gtg93]

Thanks for everyone input on this. Unfortunately this has been on the back burner for a couple of months due to moving house etc, but I'm starting back on it now. If anyone's still happy to help with this bit, I'd be very grateful as it still has me flummoxed!

 

However, your PHP is not populating the page with the id - could you share the code for view.php? Obviously, remove any login details! (though it looks like you've already put them in a separate file, which is good!)

I've made the other changes you mentioned - thanks for pointing that out. My php is attached. It's a bit messy at the moment, I plan on commenting the lines out soon to help me explain what's what and tidy it up a little. view.php.txt

 

 

Be aware though that this is very insecure, as anyone could visit that URL.

The plan is to password protect the whole folder on the server rather than implement it in the pages themselves for now... Just to remove one obstacle for me... I'd imagine it's not too difficult to add login to the php at a later date?