Unable to delete mysql record through PHP

Question

i want to delete the record in mysql database by just clicking on a link but i am unable to accomplish it, i am unable to understand the error. Here is my code

HTML

<a href="processCategory.php?action=delete?id=(<?php echo $id; ?>);">Delete</a>

processCategory.php

    <?php
    require_once '../library/config.php';
    require_once '../library/functions.php';

    checkUser();

    $action = isset($_GET['action']) ? $_GET['action'] : '';
    switch ($action) {

        case 'add' :
            addCategory();
            break;


        case 'delete' :
            deleteCategory();
            break;


        default :
            // if action is not defined or unknown
            // move to main category page
            header('Location: index.php');
    }


 function deleteCategory()
    {
        if (isset($_GET['id']) && (int)$_GET['id'] > 0) {
            $id = (int)$_GET['id'];
        } else {
            header('Location: index.php');
        }

        // delete the products
        $sql = "DELETE FROM tbl_vendors
                WHERE id = $id";
        dbQuery($sql);

        header('Location: ../vendor');
    }


    ?>

[Little Bobby](http://bobby-tables.com/) says ***[your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php)***. Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! — Jay Blanchard, Mar 31 '17 at 18:19
Shouldn't be like this: `$sql = "DELETE FROM tbl_vendors WHERE id =" . $id;` ?? What's the error you're talking about? — lealceldeiro, Mar 31 '17 at 18:20
@ Jay Blanchard but he is changing id field to int sono injection — Sugumar Venkatesan, Mar 31 '17 at 18:21
You seem to have brackets around the ID in your link `id=()` which would evaluate to `id=(1)` so try `id=` also just add exit('hello'); inside your dbQuery() to ensure your deleteCategory() function has access to dbQuery() — PhilS, Mar 31 '17 at 18:27
`()` - brackets, why? You're treating the `=` as a function. — Funk Forty Niner, Mar 31 '17 at 18:27
True @vSugumar but we should always use prepared statements regardless of how we manipulate the data. — Jay Blanchard, Mar 31 '17 at 18:36
You might want to flag Guillermo Andres Fuentes Moral as correct as that answer is also correct — PhilS, Mar 31 '17 at 18:37
@ Jay Blanchard bro using prepared statements is a good practice — Sugumar Venkatesan, Mar 31 '17 at 18:39

Guillermo Andres Fuentes Moral · Accepted Answer · 2017-03-31T18:38:07.967

1

replace ? with & and remove "(" ")" and ; in your URL

<a href="processCategory.php?action=delete?id=(<?php echo $id; ?>);">Delete</a>

Your script processCategory.php Receives in the variable id this = (1) for example your out

echo (int) "(1)";

output

The correct code for the <a> tag should be as

<a href="processCategory.php?action=delete&id=<?php echo $id; ?>">Delete</a>

edited Mar 31 '17 at 18:38

answered Mar 31 '17 at 18:26

Guillermo Andres Fuentes Moral

693
6
18

4

You may want to make your answer more clear by posting the correct code instead of the wrong code... – miken32 Mar 31 '17 at 18:33

score 0 · Answer 2 · answered Apr 01 '17 at 07:23

0

;">Delete delete "()" maybe in php get the "($id)"

answered Apr 01 '17 at 07:23

zh.ng

16

Unable to delete mysql record through PHP

2 Answers2