0

Here is the query:

$table = $_GET['type'];
$q="DELETE FROM '$table' WHERE cont_id='".$_GET['where']."'";

I also tried removing the single/double quotes on the $_GET part, but didn't work. I'm printing the values of my variables before executing the query and they are right so I don't think that's the problem.

Any ideas?

Ben
  • 8,894
  • 7
  • 44
  • 80
user3484582
  • 557
  • 1
  • 6
  • 22
  • 1
    Your code is very vulnerable to injection. You should switch to using [prepared statements](http://php.net/manual/en/pdo.prepared-statements.php). – Ben Jan 14 '16 at 10:42

3 Answers3

2

Database table names should not be enclosed with single quotes.

Corrected SQL:

$q="DELETE FROM $table WHERE cont_id='".$_GET['where']."'";

Tables and field names can be enclosed with backticks (`) to avoid clashes with

MySQL reserved keywords.

In that case, corrected SQL should be:

$q="DELETE FROM `$table` WHERE `cont_id` = '".$_GET['where']."'";

Also, do not trust input from user.

This can cause security vulnerability.

use mysqli_real_escape_string() for $_GET['where']

Pupil
  • 23,834
  • 6
  • 44
  • 66
2

In you want quote table name you had to use symbol "`" 

$table = $_GET['type'];
$q="DELETE FROM `$table` WHERE cont_id='".$_GET['where']."'";
KLin
  • 479
  • 2
  • 10
1
$table = $_GET['type'];
$q="DELETE FROM $table WHERE cont_id='".$_GET['where']."'";

OR

$table = $_GET['type'];
$q="DELETE FROM `$table` WHERE cont_id='".$_GET['where']."'";
Shailesh Katarmal
  • 2,757
  • 1
  • 12
  • 15