Not deleting the correct file in PHP

Question

I am facing problem deleting the correct files. I am displaying the list of files uploaded by the user sorted by the time of upload (last upload first). If there's a list of 3-4 files, no matter which file I click to delete, the first file in the list gets deleted, the file last uploaded that is. Here is my page displaying the files a particular user has uploaded.

<?php
$uid=$faculty_data['faculty_id']; //Assigns logged in id to a variable
$query="SELECT * FROM uploads ORDER BY datetime DESC"; //Sorts by date time
$result=mysql_query($query);
while($row=mysql_fetch_assoc($result))
{
if($uid==$row['faculty_id']) //Checks if the logged in id matches with id in DB
{
echo '<form action="delete.php" method="POST">';
echo "<strong>File: </strong>";
$url=$row['link'];  
$new="http://tofsis.com/fileshare/".$url; 
echo "<a href='$new'>$new</a><br/>";
echo "<strong>On: </strong>".$row['datetime'];
echo '<br><input type="submit" name="delete" class="btn btn" value="Delete File"/>';
echo '<hr>';
echo '</form>';
}
}
?>

And this is my delete page:

<?php
$uid=$faculty_data['faculty_id'];
$query="SELECT * FROM uploads ORDER BY datetime DESC";
$result=mysql_query($query);
if(isset($_POST['delete']))
{
 while($row=mysql_fetch_assoc($result))
{
if($uid==$row['faculty_id'])
{
 $url=$row['link'];
 $new="http://tofsis.com/fileshare/".$url; 
 $query="DELETE FROM uploads WHERE link = '$url'";
 $result=mysql_query($query);
 unlink($url);
}
}
 header('Location: my_uploads.php');
 exit();
 }
 else {
 echo '<script type="text/javascript">alert("Oops something went wrong!")</script>';
 header('Location: my_uploads.php');
 exit();
 }
?>

Can anyone please tell me where I am going wrong so that I can get my problem fixed?

Answer 1

A couple of changes should be make:

 <?php
        $uid=$faculty_data['faculty_id']; //Assigns logged in id to a variable
        $query="SELECT * FROM uploads ORDER BY datetime DESC"; //Sorts by date time
        $result=mysql_query($query);
        while($row=mysql_fetch_assoc($result))
        {
        if($uid==$row['faculty_id']) //Checks if the logged in id matches with id in DB
        { 
        $file_id = $row['id'];
        echo '<form action="delete.php" method="POST">';
        echo "<strong>File: </strong>";
        $url=$row['link'];  
        $new="http://tofsis.com/fileshare/".$url; 
        echo "<a href='$new'>$new</a><br/>";
        echo "<input type='hidden' value='$url' id='file_path' name='file_path' />";
        echo "<input type='hidden' value='$file_id' id='id_file' name='id_file' />"; // new line
        echo "<strong>On: </strong>".$row['datetime'];
        echo '<br><input type="submit" name="delete" class="btn btn" value="Delete File"/>';
        echo '<hr>';
        echo '</form>';
        }
        }
?>

On the delete page, this:

 <?php

         $file_id=$_POST['id_file'];
         $file_path = $_POST['file_path'];

         $query="DELETE FROM uploads WHERE id = $file_id";
         $result=mysql_query($query);
         unlink($file_path); //this should works on deleting the file

?>

That should do the trick ;)

Answer 2

Add another hidden input that stores the File ID and Get it in your delete script and use it

Answer 3

You create a separate POST form for each available file but none of this forms contain any information about what file they refer to. I guess that $_POST contains nothing but a delete key with Delete File as value.

In your delete page, you read data from a variable that does not exist:

$uid=$faculty_data['faculty_id']

... and then you retrieve all files from the database to compare their ID against $uid. I guess you are removing all rows when the ID is zero.

To do:

1. Enable full error reporting. That's something you need to fix before you go further; it's impossible to code without the aid of error messages. Here's a brief explanation.

2. Add a hidden field to the form with the corresponding ID.

3. Read form data from $_POST, not from an arbitrary variable.

4. Learn some basic SQL, such as the WHERE clause, so you can do something like:

   DELETE FROM uploads
   WHERE faculty_id=333
   

5. Learn about SQL injection. Use a library that provides prepared statements.