How do i DELETE a data form my database using output array to call the data and button

Question

I already tried to use href and onclick options to call my deleteAppoint. I can call it, but it won't delete any data in my database, and I don't know how to fix it properly. I've been kind of stuck in this problem for a while now.

Here is the code:

viewAppoint.php

if ($_POST) {
    $appoint_id = $_POST["appoint_id"];
    $result = "SELECT * FROM appointment WHERE appoint_id='$appoint_id'";
    $resultConn = $connect->query($result);
    $row = $resultConn->fetch_array();
}

--

<div class="row">
  <div class="col-md-12">
      <div class="panel panel-success">
        <div class="panel-heading">Listing all your Appointments</div>
        <div class="panel-body">

          <table class="tables" id="manageAppointTable" style="width:100%;">
            <thead>
              <tr>
                <th style="text-align: center;" name="appoint_id" 
                    id="appoint_id">
                     Appoint ID
                </th>
                <th style="text-align: center;">Appoint Date</th>
                <th style="text-align: center; width: 150px">Item/s</th>
                <th style="text-align: center;">Quantity</th>
                <th style="text-align: center; width: 100px">Due Date</th>
                <th style="text-align: center;">Request Status</th>
                <th style="text-align: center;">Maintenance Status</th>
                <th style="text-align: center;">Action</th>
              </tr>
            </thead>
          </table>
        </div>
    </div>  
  </div>
</div>
<script type="text/javascript" src="custom/js/appoint.js"></script>
<?php require_once 'includes/footer.php'; ?>

Here is the code to fetch my data

fetchAppoint.php

require_once 'core.php';
$sql = "SELECT appoint_id, customer_name, customer_contact, order_date, 
    quantity, due_date, item_type, description, appoint_active, appoint_status, 
    request_status FROM appointment WHERE appoint_status =  1";
$result = $connect->query($sql);
$output = array('data' => array());

if ($result->num_rows > 0) {
    $activeBrand = "";

    while ($row = $result->fetch_array()) {
        $brandId = $row[0];
        
        $buttons = '<a href="php_action/deleteAppoint.php?delete=true" 
            class="btn btn-sm btn-danger edit_cat">Delete</a>';

        $output['data'][] = array(
            $row[0],
            $row[3],
            $row[6],
            $row[4],
            $row[5],
            $activeCategory,
            $activeCategory1,
            $buttons
        );
    }
}

$connect->close();
echo json_encode($output);

Lastly, my code for delete.

deleteAppoint.php

require_once 'core.php';

$valid['success'] = array('success' => false, 'messages' => array());

if ($_POST) {
    $appoint_id = $_POST["appoint_id"];

    $sql2 = "DELETE from appointment where appoint_id = '$appoint_id'";
    
    if ($connect->query($sql2) === true) {
        header('location: http://localhost/inventory-system/viewAppoint.php');
    } else {
        echo "Failed!";
    }
}

Reading your code, it looks like you use the HTML `` tag to make the delete request. But requests made to `` are always `GET`, and in your delete code you check if the request has POST parameters. You should either send a POST request via a `
` or get the parameters in your delete script via `$_GET`. — Lucas, Oct 06 '22 at 22:07
**Warning:** You are wide open to [SQL Injections](https://php.net/manual/en/security.database.sql-injection.php) and should use parameterized **prepared statements** instead of manually building your queries. They are provided by [PDO](https://php.net/manual/pdo.prepared-statements.php) or by [MySQLi](https://php.net/manual/mysqli.quickstart.prepared-statements.php). Never trust any kind of input! Even when your queries are executed only by trusted users, [you are still in risk of corrupting your data](http://bobby-tables.com/). [Escaping is not enough!](https://stackoverflow.com/q/32391315) — Dharman, Oct 06 '22 at 22:30

score 0 · Answer 1 · answered Oct 08 '22 at 06:46

0

Additionally if you decide to get the appoint_id from GET then you must apppend it to href attribute of a tag.

answered Oct 08 '22 at 06:46

Zubair Ahmd

208
1
9

How do i DELETE a data form my database using output array to call the data and button

1 Answers1