0

I've followed a CRUD tutorial (https://www.youtube.com/watch?v=3xRMUDC74Cw&ab_channel=CleverTechie) and have everything working, but the delete message, when I delete a record. I thought maybe the button class danger was not working (outdated or w/e) for some reason and tried to change it to something else, but it still doesn't work.

Now I believe it has to do something with the fact I'm using $_GET method for deleting the records, but I'm not sure anymore. The success message and updated message are both working perfectly, but the delete message isn't.

index.php

<?php require_once 'process.php'; ?>

<?php if(isset($_SESSION['message'])): ?>

<div class="alert alert-<?=$_SESSION['msg_type']?>">

    <?php 
        echo $_SESSION['message'];
        unset($_SESSION['message']);
    ?>

</div>
<?php endif ?>

<div class="container">

    <?php
        $mysqli = new mysqli('localhost', 'root', '', 'dbase') or die(mysqli_error($mysqli));
        $result = $mysqli->query("SELECT * FROM data") or die($mysqli_error);
        //pre_r($result);
    ?>

    <div class="row justify-content-center">
        <table class="table">
            <thead>
                <tr>
                    <th>Name</th>
                    <th>Location</th>
                    <th colspan="2">Action</th>
                </tr>
            </thead>

            <?php while ($row = $result->fetch_assoc()): ?>

                <tr>
                    <td><?php echo $row['name']; ?></td>
                    <td><?php echo $row['location']; ?></td>
                    <td>
                        <a href="index.php?edit=<?php echo $row['id']; ?>"
                           class="btn btn-info">Edit
                        </a>
                        <a href="index.php?delete=<?php echo $row['id']; ?>"
                           class="btn btn-danger">Delete
                        </a>
                    </td>
                </tr>

            <?php endwhile; ?>
        </table>
    </div>

    <?php
        //pre_r($result->fetch_assoc());
        //pre_r($result->fetch_assoc());

        function pre_r($array) {
            echo '<pre>';
            print_r($array);
            echo '</pre>';
        }
    ?> 

    <div class="row justify-content-center">
        <form action="process.php" method="POST">
            <input type="hidden" name="id" value="<?php echo $id; ?>">
            <div class="form-group">
                <label>Name</label>
                <input type="text" name="name" class="form-control" 
                       value="<?php echo $name; ?>" placeholder="Enter your name">
            </div>
            <div class="form-group">
                <label>Location</label>
                <input type="text" name="location" class="form-control" 
                       value="<?php echo $location; ?>" placeholder="Enter your location">
            </div>
            <div class="form-group">
                <?php 
                    if ($update == true):
                ?>
                    <button type="submit" class="btn btn-info" name="update">Update</button>
                <?php else: ?>
                    <button type="submit" class="btn btn-primary" name="save">Save</button>
                <?php endif; ?>
            </div>
        </form>
    </div>
</div>

process.php

<?php

session_start();

$mysqli = new mysqli('localhost', 'root', '', 'pdlenart') or die(mysqli_error($mysqli));

$update = false;
$id = 0;
$name = "";
$location = ""; 

if (isset($_POST['save'])) {
    $name = $_POST['name'];
    $location = $_POST['location'];

    $mysqli->query("INSERT INTO data (name, location) VALUES('$name', '$location')") or die($mysqli_error);
        
    $_SESSION['message'] = "Record has been saved!";
    $_SESSION['msg_type'] = "success";

    header("location: index.php");
}

if (isset($_GET['delete'])) {
    $id = $_GET['delete'];

    $mysqli->query("DELETE FROM data WHERE id=$id") or die($mysqli_error);

    $_SESSION['message'] = "Record has been deleted!";
    $_SESSION['msg_type'] = "danger";

    header("location: index.php");

}

if (isset($_GET['edit'])) {
    $id = $_GET['edit'];
    $update = true;
    $result = $mysqli->query("SELECT * FROM data WHERE id=$id") or die($mysqli_error);

    if (count($result)==1) {
        $row = $result->fetch_array();
        $name = $row['name'];
        $location = $row['location'];
    }
}

if (isset($_POST['update'])) {
    $id = $_POST['id'];
    $name = $_POST['name'];
    $location = $_POST['location'];

    $mysqli->query("UPDATE data SET name='$name', location='location' WHERE id=$id") or die($mysqli_error);

    $_SESSION['message'] = "Record has been updated!";
    $_SESSION['msg_type'] = "warning";

    header("location: index.php");
}

EDIT: I've made it work by removing header(location: index.php); in the if (isset($_GET['delete'])) {} section. Not sure what happens or why.

Also I'll keep in note the comments about SQL injection, but this is about why certain functionality isn't working or is as it just happened by removing header(Location..).

  • 1
    **Warning:** You are wide open to [SQL Injections](https://php.net/manual/en/security.database.sql-injection.php) and should use parameterized **prepared statements** instead of manually building your queries. They are provided by [PDO](https://php.net/manual/pdo.prepared-statements.php) or by [MySQLi](https://php.net/manual/mysqli.quickstart.prepared-statements.php). Never trust any kind of input! Even when your queries are executed only by trusted users, [you are still in risk of corrupting your data](http://bobby-tables.com/). [Escaping is not enough!](https://stackoverflow.com/q/5741187) – Dharman Oct 05 '21 at 21:24
  • It is a very bad idea to use `die(mysqli_error($conn));` in your code, because it could potentially leak sensitive information. See this post for more explanation: [mysqli or die, does it have to die?](https://stackoverflow.com/a/15320411/1839439) – Dharman Oct 05 '21 at 21:24
  • 3
    Always `exit()` after `header('Location: ...');` – Dharman Oct 05 '21 at 21:27
  • 1
    `new mysqli('localhost', 'root', '', 'pdlenart') or die(mysqli_error($mysqli))` is not a valid piece of code. Remove that `or die`. – Dharman Oct 05 '21 at 21:27
  • 1
    Never ever use GET for delete operations. GET is performed when you open the page. This means that a simple crawler will delete everything. – Dharman Oct 05 '21 at 21:29
  • 1
    using exit() after header() solved the issue, thanks. And I'll fix other things also :). – user14584183 Oct 05 '21 at 21:33

0 Answers0