0

I try to delete a row of my Table by receiving $delwebsite, $delusername, $delpassword from a submit form. Then I have a (working) sql expression $sqlselect where I get the id of the row.

The Problem:

"Parse error: syntax error, unexpected '$id' (T_VARIABLE)" when I try to execute $sqlselect and save the result in $id.

I think its a very easy problem but I can't find it.

<?php
 IF(ISSET($_POST['delete']))
 {
    $delwebsite = $_POST['delWebsite'];
    $delusername = $_POST['delUsername'];
    $delpassword = $_POST['delPassword'];
    $sqlselect = "SELECT id FROM $loc_username WHERE website = $delwebsite AND username = $delusername AND password = $delpassword";
    $id = mysql_query($sqlselect);
    $sqldelete = "DELETE FROM $loc_username WHERE id = $id";
    if(mysql_query($sqldelete)){
    .......
    }
 }
Kas Elvirov
  • 7,394
  • 4
  • 40
  • 62
zwerg4
  • 320
  • 3
  • 5
  • 12
  • `$sqldelete = "DELETE FROM $loc_username WHERE id = $id"`; in this statement you are using a variable $id, its not defined anywhere. thats why the error – Shobi Mar 31 '18 at 12:31
  • mysql_* functions are deprecated and removed in PHP7. Use mysqli_* functions instead or PDO. – Syscall Mar 31 '18 at 12:31
  • cant I define it like this: $id = mysql_query($sqlselect); – zwerg4 Mar 31 '18 at 12:32
  • Your queries are vulnerable to SQL injections. Please read : [How can I prevent SQL injection in PHP?](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) – Syscall Mar 31 '18 at 12:33
  • i don't understand why you are fetching data from db and then try to delete? if you want to delete something, use one query `DELETE FROM $loc_username WHERE website = $delwebsite AND username = $delusername AND password = $delpassword";` this would do the trick – Shobi Mar 31 '18 at 12:35
  • The statement ```$id = mysql_query($sqlselect)``` does not put the ID returned by the query into the variable $id. $id will be an result object. You would need to use that object to fetch a row from the result, which would then contain the column values. – Sloan Thrasher Mar 31 '18 at 12:36
  • Very important! Do not use the mysql_ functions. They are depreciated, and are not even in the current version of PHP. Also, as mentioned by @Syscall, your query is vunerable to SQL injection. – Sloan Thrasher Mar 31 '18 at 12:38
  • Not reproductible : https://eval.in/981661 : no syntax error. – Syscall Mar 31 '18 at 12:38
  • "Your queries are vulnerable to SQL injections. " To rephrase that: if I am on youw website, I can delete your entire database within 10 seconds. That might alarm you a little bit more if you are not familiar with SQL injection. You should. Also you should never store passwords in a database. All in all: you are VERY wise to take a crash course on security in PHP/MySQL. Really, but for real. Do it. – Roemer Mar 31 '18 at 12:40
  • thanks guys, are the msqli functions more secure?? – zwerg4 Mar 31 '18 at 12:54

0 Answers0