Fatal error: Uncaught PDOException: SQLSTATE[42000] in DELETE

Question

Fatal error: Uncaught PDOException: SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '' at line 1.

I know there have been a lot of question with the same topic, but I am just not able to find my mistake. The mistake is in "DELETE"

This is my code in conexion.php

?php

class conexion{
    private $servidor = "localhost";
    private $usuario = "root";
    private $password = "";
    private $conexion;

    public function __construct(){

        try{
            $this-> conexion = new PDO("mysql:host = $this->servidor;dbname=proyectos",$this->usuario,$this->password);
            $this-> conexion -> setAttribute(PDO::ATTR_ERRMODE,PDO::ERRMODE_EXCEPTION);
        }catch(PDOException $e){
            return "falla de conexión".$e;
        }
    }

    public function ejecutar($sql){       
        $this -> conexion -> exec($sql);
        return $this -> conexion -> lastInsertId();
    }
    public function consultar($sql){
        $sentencia = $this -> conexion -> prepare($sql);
        $sentencia -> execute();
        return $sentencia -> fetchAll();
    }
}

?>

This is my code in: galeria.php

<?php

if($_GET){
    //"DELETE FROM proyecto WHERE `proyecto`.`id` = 1"

    $id = $_GET['borrar'];
    $obj_conexion = new conexion();
    $sql = "DELETE FROM proyecto WHERE id =".$id;
    $obj_conexion -> ejecutar($sql);
}
$obj_conexion = new conexion();
$proyectos = $obj_conexion -> consultar("SELECT * FROM  `proyecto`");
//print_r($proyectos);

?>

<tbody>
    <?php foreach($proyectos as $proyecto){ ?>
    <tr>
        <td><?php echo $proyecto['id']; ?></td>
        <td><?php echo $proyecto['nombre']; ?></td>
        <td><?php echo $proyecto['imagen']; ?></td>
        <td><?php echo $proyecto['descripcion']; ?></td>
        <td> <a name="" id="" class="btn btn-danger" href="?borrar= <?php $proyecto['id']; ?>">Eliminar</a></td>
    </tr>
    <?php } ?>
</tbody>

Note also that your code is vulnerable to SQL Injection. See [this question](https://stackoverflow.com/questions/601300/what-is-sql-injection) for more information. — Tangentially Perpendicular, Jun 12 '22 at 01:07
Does this answer your question? [How can I prevent SQL injection in PHP?](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) — Alon Eitan, Jun 12 '22 at 15:12

score 0 · Answer 1 · answered Jun 12 '22 at 01:31

Solved, I found the error, it was in the line:

<td> <a name="" id="borrar" class="btn btn-danger" href="?borrar= <?php $proyecto['id']; ?>">Eliminar</a></td>

I forgot about the "echo" in :

<td> <a name="" id="borrar" class="btn btn-danger" href="?borrar= <?php echo $proyecto['id']; ?>">Eliminar</a></td>

Fatal error: Uncaught PDOException: SQLSTATE[42000] in DELETE

1 Answers1