Simple delete query based on variable

Question

I want to delete the record when the id column is equal to $id. Would this work?

$query = "DELETE FROM $TableName WHERE id=$id";

As a side i also want to set the number of rows that can be deleted to a limit of 1. I know i have to use limit but i am unsure on its parameters

did you tried to delete the record? try to use a begin tran to go safe on that before — Zinov, Mar 30 '17 at 01:12
If you only want to delete 1 record, how do you know which one to delete? — LordBaconPants, Mar 30 '17 at 01:12
You should be sure that your id is unique, the best way would be to have it as a primary key of your table. Then you can omit the limit. And yes, it should work. — Bandydan, Mar 30 '17 at 01:17
essentially in the table you have for example 1-apple 2-pear 3-banana i want to delete apple if the admin clicks on 1 — user3687559, Mar 30 '17 at 01:18
[Little Bobby](http://bobby-tables.com/) says ***[your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php)***. Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! — Jay Blanchard, Mar 30 '17 at 13:48

Usman Shahid · Accepted Answer · 2017-03-30T01:47:35.500

-3

You could do

mysqli_query = ($con, "DELETE FROM `$TableName` WHERE id='$id' LIMIT 1");

That should do it exactly my friend

edited Mar 30 '17 at 01:47

answered Mar 30 '17 at 01:16

Usman Shahid

Can you mark this as the right answer; that would mean alot to me – Usman Shahid Mar 30 '17 at 01:35
3

`DELETE FROM '$TableName'` that will **not** work; I can assure you of that. – Funk Forty Niner Mar 30 '17 at 01:38
1

[Little Bobby](http://bobby-tables.com/) says ***[your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php)*** Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php). Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! [Don't believe it?](http://stackoverflow.com/q/38297105/1011527) – Jay Blanchard Mar 30 '17 at 13:48

1 Answers1