how to delete where id is post id, sql, php

Question

Thanks in advance. I am just learning php. I am trying to delete a post from blog I created. I should delete post by post_id which is auto incremented primary key.

But how I use post_id to WHERE clause?

my code is:

$servername = "localhost";
$username = "root";
$password = "";
$dbname = "travelogy";
try{
    $conn = new PDO("mysql:host=$servername; dbname=$dbname", $username, $password);

    //  $post_id_location->bindValue(':post_id', $post_id);
    $delete_query = "DELETE FROM post_p WHERE id ="$_POST['post_id'];
    //   $delete_query = "DELETE FROM post_p WHERE id = $post_id_location";
    $conn->exec($delete_query);
    echo "Record deleted.";
    }catch(PDOException $e){
        echo $delete_query."<br>".$e->getMessage();
    }
$conn = null;

BUT Error Notice: Undefined variable: post_id_location in C:\xampp\htdocs\CMS_project\pdo.php on line 10 Fatal error: Uncaught Error: Call to a member function bindValue() on null in C:\xampp\htdocs\CMS_project\pdo.php:10 Stack trace: #0 {main} thrown in C:\xampp\htdocs\CMS_project\pdo.php on line 10

Possible duplicate of ["Notice: Undefined variable", "Notice: Undefined index", and "Notice: Undefined offset" using PHP](https://stackoverflow.com/questions/4261133/notice-undefined-variable-notice-undefined-index-and-notice-undefined) — , Mar 19 '19 at 20:36
`$delete_quary = "DELETE FROM post_p WHERE id ="$_POST['post_id'];` should be `$delete_quary = "DELETE FROM post_p WHERE id ='{$_POST['post_id']}';"` But really, you should be validating that POST variable first to avoid SQL injection attacks — Stevish, Mar 19 '19 at 20:38
is it `post_id_location` or `post_id` both are in your code, how is this set? — , Mar 19 '19 at 20:38
Don't include POST values in a query string for security issues. Read about SQL injection and PHP Prepared Statements. — JeffProd, Mar 19 '19 at 20:40
thanks a lot to you all. @stevish you code work perfect. but now another error happened. Parse error: syntax error, unexpected '$conn' (T_VARIABLE) in C:\xampp\htdocs\CMS_project\pdo.php on line 14 — Shaik, Mar 19 '19 at 20:58
Your error message doesn't make sense with the code you've provided -- `post_id_location` is only referenced in comments. — , Mar 19 '19 at 21:28
Oops, I forgot the semicolon on the end of the second line in my example. — Stevish, Mar 22 '19 at 21:14

score -1 · Answer 1 · edited Jun 27 '19 at 19:15

-1

Change:

$delete_query = "DELETE FROM post_p WHERE id ="$_POST['post_id'];

To:

$delete_query = "DELETE FROM post_p WHERE id = " . $_POST['post_id'];

Or:

$post_id = $_POST['post_id'];
$delete_query = "DELETE FROM post_p WHERE id = '$post_id'";

edited Jun 27 '19 at 19:15

marc_s

732,580
175
1,330
1,459

answered Mar 19 '19 at 21:25

Marc Hinton

1
1

1

this code is open to SQL injection attacks and should never be used – Mar 19 '19 at 21:41
1

Passing form data directly into sql queries makes this code vulnerable to sql injection attack – Nancy Moore Mar 19 '19 at 21:42
@Nancy Mooree, what is your suggestion? Thanks in advance. – Shaik Mar 19 '19 at 22:34
@Shaik In order to avoid sql injection, you need to _prepare your statements_, e.g. to use the so-called [prepared statements](https://secure.php.net/manual/en/pdo.prepared-statements.php). Your sql statement will then look like `DELETE FROM post_p WHERE id = :id`. Or like `DELETE FROM post_p WHERE id = ?`. – PajuranCodes Mar 20 '19 at 00:27
@Shaik Personally, I would recommend you to read: [(The only proper) PDO tutorial](https://phpdelusions.net/pdo), [Error reporting basics](https://phpdelusions.net/articles/error_reporting) and [The Hitchhiker's Guide to SQL Injection prevention](https://phpdelusions.net/sql_injection). And, of course, to thoroughly study the [PHP Manual](https://secure.php.net/manual/en/index.php) for each PHP/PDO function/method used. – PajuranCodes Mar 20 '19 at 00:28

how to delete where id is post id, sql, php

1 Answers1