Delete row in mysql via form input by id

Question

I am attempting to remove mysql row data via input from a form. I can not get the data to delete from my table or throw any errors. I simply would like to type in my form in the id I would like to remove from my database.

<?php 
$con = mysql_connect("localhost","root","######");
if (!$con)
{
die('Could not connect: ' . mysql_error());
}

mysql_select_db("test", $con);
$sql = mysql_query("DELETE FROM `Blog` WHERE `Id` = '$id'")  or die (mysql_error());

$id = $_GET['Id'] ;
?>

<form action="#" method="get">
 Delete: <input type="text" name="Id"><br>  
         <input type="submit" value="delete">
</form>

You must first [read over this question thoroughly though](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php). Your code is vulnerable to SQL injection, and indeed it is trivially easy for anyone to delete everything in your table. Turn up error_reporting and show errors on screen (always while developing code) and you'll see notices about undefined variables. `error_reporting(E_ALL); ini_set('display_errors', 1);` — Michael Berkowski, Apr 04 '14 at 17:51
Ok thanks Michael. I moved the $id up about the query and it works now. I have tried attaching the error_reporting that you gave me but it breaks every time. — Thomas Lyle, Apr 04 '14 at 18:10

score 0 · Answer 1 · answered Oct 25 '14 at 07:39

Try this call the $id first and delete query next.

 <?php 
    $con = mysql_connect("localhost","root","######");
    if (!$con)
    {
    die('Could not connect: ' . mysql_error());
    }
    mysql_select_db("test", $con);

    $id = $_GET['Id'] ;
    $sql = mysql_query("DELETE FROM `Blog` WHERE `Id` = '$id'")  or die (mysql_error());


    ?>

<form action="#" method="get">
 Delete: <input type="text" name="Id"><br>  
         <input type="submit" value="delete">
</form>

score 0 · Answer 2 · answered Oct 25 '14 at 07:39

0

Use this define $id before query and if your id field in your database type intager try this {$id}

$id = $_GET['Id'] ;
$sql = mysql_query("DELETE FROM `Blog` WHERE `Id` = {$id}")  or die (mysql_error());

answered Oct 25 '14 at 07:39

Harutyun Abgaryan

2,013
1
12
15

Delete row in mysql via form input by id

2 Answers2