searching for existing data, double if php

Question

I am working on a webpage and I want to have a possible delete button which works in the following manner:

 - you introduce a country ISO code which you want to delete
 - click the button
 - if the country has players participating (competitor table, ISO_country_code column) then prints the message that this cannot happen
 - if not, deletes the country from country table

I tried in the following way, but I don't know how to create the condition of the second if in order to achieve the appropiate working.

$connect=mysqli_connect("localhost","root","","mydatabase");
if (mysqli_connect_errno())
  {
  echo "Failed to connect to MySQL: " . mysqli_connect_error();
  }
 else 
 {
    $result=mysqli_query($connect,"SELECT COUNT(*) FROM competitor
        WHERE ISO_country_code='".$_POST['countrycode']."')")
    if ($result>0)
    {
        echo 'The following country is involved with players, so it can not be deleted!</br></br>';
    }
    else (mysqli_query($connect,"DELETE FROM country WHERE     ISO_country_code='".$_POST['countrycode']."'"));
    {
        echo 'The following country was deleted: '.$_POST["countrycode"]."</br>";
    }
}

please note that `1'; drop table country; '"` in the post would be quite dramatic — njzk2, Jan 14 '14 at 10:48
That you might want to start using prepared statements instead...best SQL injection protection there is. — NewInTheBusiness, Jan 14 '14 at 10:57

score 0 · Answer 1 · answered Jan 14 '14 at 10:51

You had some syntax errors + probably didn't get nr of rows you were looking for.

$connect=mysqli_connect("localhost","root","","mydatabase");
if (mysqli_connect_errno())
  {
  echo "Failed to connect to MySQL: " . mysqli_connect_error();
  }
 else 
 {
    $result=mysqli_query($connect,"SELECT * FROM competitor
        WHERE ISO_country_code='".$_POST['countrycode']."'");
     $rows = mysql_num_rows($result);
    if ($rows>0)
    {
        echo 'The following country is involved with players, so it can not be deleted!</br></br>';
    }
    else {
      mysqli_query($connect,"DELETE FROM country WHERE ISO_country_code='".$_POST['countrycode']."'");
        echo 'The following country was deleted: '.$_POST["countrycode"]."</br>";
  }
}

That is a good point, however still enters the second if when it shouldn't. — kemenesendre, Jan 14 '14 at 11:02

score 0 · Accepted Answer · answered Jan 14 '14 at 11:01

Your $result is containing no integer, it returns true or false (or an object, when using the object-oriented way).

If you want to check how many results your query returns you have to replace your $result with the mysqli_num_rows($result) function.

And you should take a look at prepared statements to prevent SQL Injection.

First, you have to create a prepared statement of your query with:

$stmt = mysqli_prepare($connect,"SELECT * FROM competitor WHERE ISO_country_code=?");

Then you bind the parameter to the statement (s stands for "String"):

mysqli_stmt_bind_param($stmt,"s",$_POST['countrycode']);

And execute your statement:

mysqli_stmt_execute($stmt);

You can then get the results for example with mysqli_stmt_fetch($stmt).

score 0 · Answer 3 · answered Jan 14 '14 at 11:02

0

Try this..

if(mysql_num_rows($result) > 0)
    {
    echo "cannot delete";
    }
    else if(mysql_num_rows($result) == 0)
    {
     //write the query for deletion
    echo "deleted";
    }

answered Jan 14 '14 at 11:02

Deepu Sasidharan

5,193
10
40
97

searching for existing data, double if php

3 Answers3