delete from database not working using php

Question

if(isset($_POST['submit']))
{
    $Team = $_POST['Team'];
    echo "$Team" ; 
    $sql = "DELETE FROM championsleauge WHERE Team = $Team "; 
    if($con->query($sql) === TRUE)
    {
        echo "New delete successfully";
    } 

}

the delete is not working. it does echo the team name to be deleted any ideas?

echo $sql and run query direct in mysql database and check error. — RJParikh, Apr 28 '16 at 08:23
`$Team` must be a string. Mind adding some error checking to your code? And some ***protection***? — Hanky Panky, Apr 28 '16 at 08:23
Query have an error. Use `$Team` in single quote. It's string. — Sibiraj PR, Apr 28 '16 at 08:24
besides the fact you should use PDO etc etc. Use quotes around your variables to let it work. Readup: http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php?rq=1 — Johan, Apr 28 '16 at 08:25
What do you think happens when I fill in this string in team: `'test' OR 1=1` — Daan, Apr 28 '16 at 08:25

score 2 · Accepted Answer · edited May 23 '17 at 11:52

2

This does not answer your question, but it can open your eyes!

DELETE FROM championsleauge WHERE Team = $Team

Send this value to your POST variable named Team

5 OR 1=1

It will become

DELETE FROM championsleauge WHERE Team = 5 OR 1=1

And there you go, no more champion leagues!

BTW, your error is a simple typo. String values need to be quoted. Then you have no error checking at all. Then you need to go through

How can I prevent SQL injection in PHP?

PDO is not as scary as it sounds, you code can be as simple as this

$dbh = new PDO('mysql:dbname=testdb;host=127.0.0.1', $user, $password);
$sth=$dbh-prepare("DELETE FROM championsleauge WHERE Team = ?");
$sth->execute(array($Team));

edited May 23 '17 at 11:52

Community

1
1

answered Apr 28 '16 at 08:25

Hanky Panky

46,730
8
72
95

hey i know i can use i think html entities to prevent sql injection ? just under a bit of pressure to get a working prototype for a demo – Broomer Apr 28 '16 at 08:37
See the updated answer – Hanky Panky Apr 28 '16 at 08:46

delete from database not working using php

1 Answers1