My delete button is not functioning as expected

Question

I'm stuck in the delete function, I wonder why my delete button is not functioning, and I already edited my code.

<?php  
if ($_SERVER["REQUEST_METHOD"] == "POST") 
{
    $semester = ($_POST["semester"]);
    $level = ($_POST["level"]);
}
?>

Here is the form method:

<form method="post" action="<?php echo($_SERVER["PHP_SELF"]);?>"     enctype="multipart/form-data">

Here is to display the data in table form, and SELECT * is functioning

$sql = mysqli_query ($connection, "SELECT * FROM subject");

    echo " <table>
    <th>Semester</th>
    <th>Level</th>
    </tr>";

while($record = mysqli_fetch_assoc ($sql)){
    echo "<tr>";
    echo "<td>" . $record['semester'] . "</td>";
    echo "<td>" . $record['level'] . "</td>";
    echo "<td>" . "<input type=submit name=delete value=Delete>" . "</td>";
    echo "</tr>";
}

This is the delete button code

if (isset($_POST['delete']))
{

    $delete = mysqli_query ($connection, "DELETE FROM subject WHERE semester = '($_POST[semester])'");


}

There is nothing wrong with `delete`, there is a problem with _what to delete_. You have not `post`ed anyhting. — Aleksei Matiushkin, Jan 19 '15 at 13:44
**Danger**: You are **vulnerable to [SQL injection attacks](http://bobby-tables.com/)** that you need to [defend](http://stackoverflow.com/questions/60174/best-way-to-prevent-sql-injection-in-php) yourself from. — Quentin, Jan 19 '15 at 13:45
Can you please specify if your select statement works ? Because I don't see any initialization of your connection. — Laurent Crivello, Jan 19 '15 at 13:45
`mysqli_query ($connection, "DELETE FROM subject WHERE semester = '($_POST[semester])'");` are you storing the semester with parenthesis in the database? — rasso, Jan 19 '15 at 13:45
I would upvote @Quentin's comment again if I could. Vicky - once you have this working, please spend some time reading about SQL Injection if you haven't already done so. — James Thorpe, Jan 19 '15 at 13:51
See this Q&A http://stackoverflow.com/q/15605366/ which may very well be a duplicate. — Funk Forty Niner, Jan 19 '15 at 13:54
**[DANGER! You need to prevent SQL Injection!](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php)** — Jay Blanchard, Jan 19 '15 at 13:56
Well, he would hold a sign up with *"YIPES!"* on it ;-) [Morning @Fred-ii-](https://www.youtube.com/watch?v=p_u3YRZb74w) — Jay Blanchard, Jan 19 '15 at 13:58
@JayBlanchard Mornin' Ralph. - I didn't even need to see that link lol and I knew right away hahaha — Funk Forty Niner, Jan 19 '15 at 13:59

toto21 · Answer 1 · 2015-01-19T15:28:46.813

Try this :

         while($record = mysqli_fetch_assoc ($sql)){
           echo "<tr>";
           echo '<form action="mypage.php" method="post">';
           echo "<td>" . $record['semester'] . "</td>";
           echo "<td>" . $record['level'] . "</td>";
           echo "<td>" . $record['course'] . "</td>";
           echo "<td>" . $record['subject'] . "</td>";
           echo "<td>" . $record['section'] . "</td>";
        // And add field form hidden
           echo '<input type="hidden" name="semester" value="'.$record['semester'].'">';
           echo "<td>" . '<input type="submit" name="delete" value="Delete">' . "</td>";
           echo "</form>";
           echo "</tr>";
        }

   if (isset($_POST['delete']) && isset($_POST['semester']))
{
$stmt = $connection->prepare('DELETE FROM subject WHERE semester = ?');
// if $_POST['semester'] is integer else see http://php.net/manual/en/mysqli-stmt.bind-param.php
$stmt->bind_param('i', $_POST['semester']);

$stmt->execute();
}

Give displaying your select : `echo "
; print_r($record); echo "
";` — toto21, Jan 20 '15 at 13:02

My delete button is not functioning as expected

1 Answers1