0

I have some files in the directory ../gallery/drawingimage/ i have to delete a file. I have written the following code. But it is not working.

<?php
include("../gallery/includes/connection.php");

$file = $_POST['fname'];

if($_POST['ptype']=='drawing'){
        $delete = mysql_query("DELETE FROM drawing WHERE pname = '$file'") or die(mysql_error());

         $data=$file.".jpg";
         $dir = "../gallery/drawingimage/".$data;
        // echo $dir;
         unlink('$dir');

    }


//  header("Location: ../cpanel.php");
Rahi M.
  • 5
  • 3
  • 1
    off-topic: you are vulnerable to sql injection. – Si8 Nov 04 '13 at 21:50
  • 3
    **Danger**: You are using [an **obsolete** database API](http://stackoverflow.com/q/12859942/19068) and should use a [modern replacement](http://php.net/manual/en/mysqlinfo.api.choosing.php). You are also **vulnerable to [SQL injection attacks](http://bobby-tables.com/)** that a modern API would make it easier to [defend](http://stackoverflow.com/questions/60174/best-way-to-prevent-sql-injection-in-php) yourself from. – Quentin Nov 04 '13 at 21:54

2 Answers2

0

remove the single quotes - use

unlink($dir);

instead of

unlink('$dir');
Zali
  • 311
  • 2
  • 5
0

To clarify Zali's answer, php makes a distinction between single and double quotes, and no quotes at all. Single quotes are not parsed for variables. For example, the following:

$x = "Some Text"

print $x;

Some Text

print "$x";

Some Text

print '$x';

$x

TrippyD
  • 735
  • 5
  • 9