i want to Delete where id=$POST['id'] in php mysql

Question

My code for delete entry is this but its not doing anything

HTML

<form id="form3" name="form3" method="post" onsubmit="return validateForm();" action="">
    Id <input type="text" class="txt" name="id" /><br />
    <input type="submit" id="delete" value="delete"/>
</form>

PHP

global $wpdb;

if ( isset ( $_POST['id'] ) && ! empty ( $_POST['id']  ))
{
    $wpdb->query("DELETE " . PRO_TABLE_PREFIX . "tutorial  WHERE id='{$_POST['id']}'");
}

@PhilemonphilipKunjumon If you are talking about in the string it is because when using an array with a key, you have to wrap the entire thing in `{` `}` tags otherwise it will treat `$_POST` as the variable and `['id']` as a plain string. — Supericy, Jan 01 '13 at 07:12
last question was same but only it was upate. Now delete.... Next insert probably? — itachi, Jan 01 '13 at 07:16
Please add at least a check to make sure that $_POST['id'] is an int. Your code is vulnerable to SQL injections. — wakooka, Jan 01 '13 at 07:25
Since you're new to PHP/SQL, **please pay heed to** http://stackoverflow.com/questions/60174/how-to-prevent-sql-injection-in-php — , Jan 01 '13 at 21:38

syrkull · Answer 1 · 2013-01-03T05:51:46.287

1

that is how I usually do it:

$wpdb->query("DELETE " . PRO_TABLE_PREFIX . "tutorial  WHERE id='".$_POST['id']."')

edited Jan 03 '13 at 05:51

answered Jan 01 '13 at 07:10

syrkull

2,295
4
35
68

2

is this work surely?? `id=.'"$_POST['id']"'."` or should be `id='".$_POST['id']."'` – jogesh_pi Jan 01 '13 at 07:15

Yang · Answer 2 · 2013-01-01T07:55:02.443

1

In oder to avoid confusion like this, I always use sprintf() where I need to concatenate strings

Change:

global $wpdb;
if ( isset ( $_POST['id'] ) && ! empty ( $_POST['id']  )) {
    $wpdb->query("DELETE " . PRO_TABLE_PREFIX . "tutorial  WHERE id='{$_POST['id']}'");
}

to:

global $wpdb;

if ( isset ( $_POST['id'] ) )) {    

   $wpdb->query(sprintf("DELETE %stutorial  WHERE id='%s'", PRO_TABLE_PREFIX, $_POST['id']));
}

A couple of things to note:

1) You're vulnerable to SQL injection
2) Once you've used isset() to determine if the key of $_POST['id'] actually isn't NULL, you don't need to check if its empty via empty()

Update

You should really test $_POST['id'] if its valid. I'd suggest you to implement a function, like, is_id_valid()

function is_id_valid(&$id){ //<-- IMPORTANT, Argument should be a reference 

  if ( ! isset($id) ){
     return false;
  }

  if ( empty($id) ){
    return false;
  }

  // add this if you expect $id to be a numeric value
  // otherwise just ignore - do not add
  if ( ! is_numeric($id) ){
    return false;  
  }

  //it's also a good to validate the length 
  if ( strlen($id) > ... && strlen($id) < ... ){
     return false;
  } 

  //seems like all tests passed
  return true;
}

Then you would use it, like

if ( is_id_valid($_POST['id']) !== false ){
   ....
}

Warning: It's still vulnerably to SQL injection

edited Jan 01 '13 at 07:55

answered Jan 01 '13 at 07:32

Yang

8,580
8
33
58

@GabrielSantos I meant it comes down to `E_NOTICE` – Yang Jan 01 '13 at 07:37
Sorry? I don't understand you. – Gabriel Santos Jan 01 '13 at 07:38
The correct should be `if (!empty($_POST['id']))) {` because form will send ever the `id` index, but, with empty value if nothing is typed. – Gabriel Santos Jan 01 '13 at 07:44
@GabrielSantos you're right, but it will throw a `E_NOTICE` then, while `isset()` won't – Yang Jan 01 '13 at 07:46
Why the `E_NOTICE` if form index will be always defined, even you post a full or empty form? – Gabriel Santos Jan 01 '13 at 07:48
Yes, in that case if `form index will always be defined` and only, `empty()` makes more sense. But in general, it's better to ensure if it does actually exists if we're going to avoid unexpected results. – Yang Jan 01 '13 at 07:59
In general is better to check if is set and not empty, or, when you know it is defined, verify if not empty. – Gabriel Santos Jan 01 '13 at 15:12

Suresh Kamrushi · Answer 3 · 2013-01-01T07:14:15.870

0

Remove single quote around post['id']:

$wpdb->query("DELETE " . PRO_TABLE_PREFIX . "tutorial  WHERE id={$_POST['id']}")

OR

echo $query = "DELETE " . PRO_TABLE_PREFIX . " tutorial  WHERE id =".mysql_real_escape_string($_POST['id']);
$wbpd->query($query);

edited Jan 01 '13 at 07:14

answered Jan 01 '13 at 07:08

Suresh Kamrushi

15,627
13
75
90

3

you escape the string with `mysql_`, but then use PDO to execute the query. (facepalm) – Cole Tobin Jan 01 '13 at 07:13
@user1890857: try to echo the query. is query is building correctly? – Suresh Kamrushi Jan 01 '13 at 07:16
Notice: Undefined variable: wbpd Fatal error: Call to a member function query() on a non-object in – user1890857 Jan 01 '13 at 07:25
@user1890857 don't remove `global $wpdb;`. – Gabriel Santos Jan 01 '13 at 07:27

score 0 · Answer 4 · answered Jan 01 '13 at 07:11

0

$wpdb->query("DELETE FROM " . PRO_TABLE_PREFIX . "tutorial  WHERE id='{$_POST['id']}'");

PS: Go overthere and accept one answer who helped you most. And here too! :P

answered Jan 01 '13 at 07:11

Xfile

674
8
19

@user1890857 - You must accept answers in order for us to give you the right codes.. and this one, although its working is wrong. – Xfile Jan 01 '13 at 07:23
Just think about help someone. More reputation will not grant you a reward. – Gabriel Santos Jan 01 '13 at 07:26
@Gabriel Santos - Well if someone is to lazy or whatever to press one button in exchange for 20 mins help (this is 3rd time).. I think that person deserves everything else but help. Thx for nice words though ;) – Xfile Jan 01 '13 at 07:36
He may be lazy or you may have not the solution. I understand you (: – Gabriel Santos Jan 01 '13 at 07:41
1

@Gabriel Santos - Yes. That is the thing for sure :D – Xfile Jan 01 '13 at 07:46
@user1890857 No, you are not lazy, sorry if you understood wrong. Re-read the comments above. – Gabriel Santos Jan 01 '13 at 07:50
@user1890857 - You are lazy because you are not rewarding people who are helping you with accepting their answers. That is a point of this domain. And it is important because someone, who has problem same as you will see which answer helped you to solve that problem. When you receive good codes, click on "correct answer" and thats it! So simple. – Xfile Jan 01 '13 at 07:57

score 0 · Answer 5 · answered Jan 01 '13 at 07:24

0

Try following code:-

global $wpdb;

if ( isset ( $_POST['id'] ) && ! empty ( $_POST['id']  ))
{
$wpdb->query("DELETE FROM " . PRO_TABLE_PREFIX . "tutorial  WHERE id=".$_POST['id']);
}

answered Jan 01 '13 at 07:24

The Real Coder

138
1
7

it deleting after submit 2nd time why? – user1890857 Jan 01 '13 at 07:29
Excuse me, I didn't understand. Can you explain what you mean? – The Real Coder Jan 01 '13 at 07:31
when i enter the id in text field and then enter on submitt button its do nothing in first time – user1890857 Jan 01 '13 at 07:33
it deletes after second time when i press submit button – user1890857 Jan 01 '13 at 07:34
1

It means, when you submit first time, the "id" is not submitted. Check how you are handling form submission. – The Real Coder Jan 01 '13 at 07:35
it executes the query after second time – user1890857 Jan 01 '13 at 07:38
1

Please either 1) write safe code *or* 2) clearly state the issue(s) with the provided code – Jan 01 '13 at 21:39

score 0 · Answer 6 · answered Jan 01 '13 at 08:05

give some action path to the form

html

<form id="form3" name="form3" method="post" onsubmit="return validateForm();" action="give some actions">
Id <input type="text" class="txt" name="id" /><br />
<input type="submit" id="delete" value="delete"/>

php

global $wpdb;

if ( isset ( $_POST['id'] ) && ! empty ( $_POST['id']  ))
{
  $id=stripslashes_deep($_POST['id']);
  $wpdb->query("DELETE FROM " . PRO_TABLE_PREFIX . "tutorial  WHERE id=$id");
}

Sudhir Bastakoti · Accepted Answer · 2013-01-02T04:57:32.053

-1

Since you are checking for id in WHERE clause, you need not wrap it in quotes, and you are missing FROM in your delete statement, so standard way would be: And do some filtering of POST data before inserting into database , like doing:

$id = (int) $_POST['id'];
if( $id > 0 ) {
    $wpdb->query("DELETE FROM " . PRO_TABLE_PREFIX . "tutorial  WHERE id=".$_POST['id']);
}

edited Jan 02 '13 at 04:57

answered Jan 01 '13 at 07:13

Sudhir Bastakoti

99,167
15
158
162

2

-1 Please either 1) write acceptably safe code *and/or* 2) clearly state the issue(s) with the provided code. **Answers like this just continue the promotion of *bad, unsafe code*.** – Jan 01 '13 at 21:40
i guess adding some comment along with the answer made it clear then before... ! – Sudhir Bastakoti Jan 02 '13 at 04:17
1

The quotes (or lack thereof) aren't the problem. The [SQL injection](http://en.wikipedia.org/wiki/SQL_injection) is :( Here are [some practical demonstrations](http://www.unixwiz.net/techtips/sql-injection.html) and solutions. – Jan 02 '13 at 04:29
@Sudhir you clearly copied my own answer because I made the same typo. you should be ashamed of yourself :( it is `id=".$_POST['id']."` not `id=".$_POST['id']` – syrkull Jan 03 '13 at 05:48
@shnisaka look carefully i dont have single quotes in id='"... where do you see it...? – Sudhir Bastakoti Jan 03 '13 at 05:49

i want to Delete where id=$POST['id'] in php mysql

7 Answers7