Php Delete syntax

Question

I have a guestbook for a school assignment, now i need to delete posts but only the logged on user can delete his own posts.

How can i write the delete syntax? I was thinking something like:

if ($_GET['Deletebutton']) {

mysql_query("DELETE FROM guestbook WHERE $id ='PostID' AND $username='Username'");

}

Im posting my code for the page down below!

<h1>Välkommen till gästboken!</h1>
<h2>Posta till Gästboken</h2>
<form action="home.php" method="post">
    <table>
        <tr>

            <td>Titel:</td>
            <td><input type="text" name="titel" style="width: 600px;"/></td>
        </tr>

        <tr>
            <td>Inlägg:</td>
            <td><textarea name="inlägg" style="width: 600px; height: 300px;"></textarea></td>
        </tr>
        <tr>
            <td></td>
            <td><input type="submit" name="postknapp" value="Posta"/></td>
        </tr>
    </table>
</form>
<p>

    <a href="logga_ut.php">Logga ut</a>
    <?php
    session_start();
    $username = $_SESSION['username'];
    if ($_SESSION['login'] == 1) { //om sessionen är 1 så
        // Connect to the database
        mysql_connect("localhost", "root", "");
        mysql_select_db("guestbookdatabase");
//******************************************************************//
//Display stuff
        echo "<h1>Nuvarande Poster</h1>";

        if ($_POST['postknapp']) {

            $title = strip_tags($_POST['titel']);
            $message = strip_tags($_POST['inlägg']);

            if ($title && $message) {

                //Lägg till i databasen
                mysql_query("INSERT INTO guestbook (Title,Post,Username) VALUES  ('$title','$message','$username')");

                echo "Ditt inlägg har lagts till i gästboken!";
            }
            else
                echo "Du har inte fyllt i nödvändig information för att kunna göra ett inlägg.";
        }
        $query = mysql_query("SELECT * FROM guestbook ORDER BY PostID DESC");
        $numrows = mysql_num_rows($query);
        if ($numrows > 0) {
            while ($row = mysql_fetch_assoc($query)) {
                $id = $row['PostID'];
                $name = $row['Username'];
                $title = $row['Title'];
                $message = $row['Post'];
                $date = $row['Timestamp'];
                $message = nl2br($message);
                echo "<div> 
    Av <b>$name</b> vid <b>$date</b><br /> 
    <h2>$title</h2> <p>
    $message  <p>
    <div align = 'right'><input type='button' name='Raderaknapp' value='Ta bort  inlägget' />
    </div></div><hr />";

                if ($_GET['Raderaknapp']) {

                    mysql_query("DELETE FROM guestbook WHERE $id ='PostID' AND  $username='Username'");

                    echo "Inlägget har tagits bort!";
                }
            }
        }
        else
            echo "Inga inlägg hittades.";
        mysql_close();
    } else { // om session inte är 1 så 
        echo "Du har INTE tillåtelse till gästboken! Klicka på länken för att logga in!";
        ?>
    <p>
        <br/><a href="index.html">Till login >></a>
        <?php
    }
    ?>

I think you mean `PostID='$id' AND Username='$username'` (not `$id ='PostID' AND $username='Username'`). — gen_Eric, Feb 13 '13 at 18:24
Your SQL is incorrect. `'` is used to delimit strings. if you quote field names with `'`, they're not long field names - they're strings. directly inserting strings from PHP without quotes will also cause syntax errors. Read http://bobby-tables.com for details about SQL injection attacks. — Marc B, Feb 13 '13 at 18:24
[**Please, don't use `mysql_*` functions in new code**](http://bit.ly/phpmsql). They are no longer maintained [and are officially deprecated](http://j.mp/XqV7Lp). See the [**red box**](http://j.mp/Te9zIL)? Learn about [*prepared statements*](http://j.mp/T9hLWi) instead, and use [PDO](http://php.net/pdo) or [MySQLi](http://php.net/mysqli) - [this article](http://j.mp/QEx8IB) will help you decide which. — Kermit, Feb 13 '13 at 18:25
Yes i know though if i don't use the ' it just says error in my code when using ". I followed a tutorial first where he used the ' when writing the code then i have succesfully builded up the code on my own and adapted it to my needs. How can i then change the ' to " ? Thanks for the constructive feedback! — William Bergendahl, Feb 13 '13 at 18:30

score 2 · Answer 1 · edited Feb 13 '13 at 18:37

2

Try:

mysql_query("DELETE FROM guestbook WHERE PostID = '".$id."' AND Username = '".$name."'");

DELETE Documentation

edited Feb 13 '13 at 18:37

kittycat

14,983
9
55
80

answered Feb 13 '13 at 18:27

SeanWM

16,789
7
51
83

That should work by all means. Are you sure the $id and $name passed really exist in the database before deletion? – Gargron Feb 13 '13 at 18:37
@WilliamBergendahl try now, I updated to the correct column names. – kittycat Feb 13 '13 at 18:38
Hmmm still not working when trying to delete! :/ This is what i have tried: if ($_GET['Raderaknapp']) { mysql_query("DELETE FROM guestbook WHERE PostID = '".$id."' AND Username = '".$name."'"); echo "Inlägget har tagits bort!"; } – William Bergendahl Feb 13 '13 at 18:47
Could the problem be something related to this that show what the post should contain? echo "
Av $name vid $date

$title

$message

"; – William Bergendahl Feb 13 '13 at 18:48
@WilliamBergendahl change `mysql_query` in above answer to `echo` and post the output. Let's see if the query is building correctly. – kittycat Feb 14 '13 at 14:57
@cryptic Nothing is happening or responding when pressing the delete button after changing the mysql_query to echo. I think the code is correct though the input type button is marked as comment lines though the button shows. Though i dont know where to put the button else since if i put it anywhere else it wont be showing for each and every post right? so where should i try to put it? – William Bergendahl Feb 16 '13 at 16:35
@WilliamBergendahl it not suppose to do anything. I just want you to post the output of the echo so we know that the query is properly being built put an `exit;` after the echo as well just to be sure script does not redirect you. – kittycat Feb 16 '13 at 16:51
@cryptic Nothing is happening :( – William Bergendahl Feb 18 '13 at 09:57
The issue is that your `Raderaknapp` button is not in a form. – SeanWM Feb 18 '13 at 13:04
i Tried putting it after the message in a form and linking it to a delete.php file though when using the delete syntax it wont delete anyways? :/ – William Bergendahl Feb 18 '13 at 13:58

score 1 · Answer 2 · edited May 25 '19 at 14:38

Please, don't use mysql_* functions in new code. They are no longer maintained and are officially deprecated. Learn about prepared statements instead, and use PDO, or MySQLi Here is a good tutorial for PDO.

Now, if you want to continue with this however.

  if ($_GET['Deletebutton']) {
    $id = mysql_real_escape_string($_POST['id']);
    $username = mysql_real_escape_string($_POST['username']);


    mysql_query("DELETE FROM guestbook WHERE id ='".$id."' AND username='".$username."'")
 or die("My SQL can not perform this task right now");

    }

Php Delete syntax

2 Answers2

$title