Php CRUD app: using Ajax to delete row returns an entire page

Question

I have made a CRUD application using PHP and Bootstrap.

My delete_record.php file contains the following code:

<?php

include("includes/header.php");
include("includes/nav.php");

if (isset($_GET['mid'])) {
  $sql = "DELETE FROM medical_records WHERE mid = " . $_GET['mid'];
  //echo $sql;
  if (mysqli_query($con, $sql)) {
    //header("Location: {$_SERVER['HTTP_REFERER']}");
    echo "Record successfully deleted";
  } else {
    echo "Error: " . mysqli_error($con);
  }
}?>
<?php include("includes/footer.php"); ?>

The page used to make a simple redirect to the previous url with this line:

header("Location: {$_SERVER['HTTP_REFERER']}");

I have commented it out in order to "Ajaxify" the process. For this purpose I have used:

$('.delete-icn').on('click', function(evt){
    evt.preventDefault();
    var mid = $(this).data('mid');

    if(confirm('Are you sure you want to delete?')) {
        $.ajax({
            url: 'delete_record.php?mid=' + mid,
            method: 'GET',
            data: {mid:mid},
            success: function(deleteMsg){
                $('#delete_msg').slideDown(250);
                $('#delete_msg').text(deleteMsg);
            }
        });
    }
});

But this not only does not delete the record, it returns the html of an entire page inside the alert paragraph tag <p id="delete_msg" class="text-center alert alert-success"></p> instead of only "Record successfully deleted";

Where is the mistake? Thank you!

UPDATE: In the delete_record.php file I have kept only:

if (isset($_GET['mid'])) {
   $sql = "DELETE FROM medical_records WHERE mid = " . $_GET['mid'];
   if (mysqli_query($con, $sql)) {
     //header("Location: {$_SERVER['HTTP_REFERER']}");
     echo "Record successfully deleted";
   } else {
    echo "Error: " . mysqli_error($con);
   }
}?>

No significant change happened as a result of this.

You are also doing include() of other php files.... if you only want your echo then only do your echo — Patrick Evans, Apr 08 '17 at 22:04
I have changed method: 'POST', to method: 'GET', still, the entire code of delete_record.php is returned. — Razvan Zamfir, Apr 08 '17 at 22:11

miken32 · Accepted Answer · 2017-09-13T16:46:37.103

Ok, your answer may work fine, but here's a question. What happens when someone calls http://example.com/delete_record.php?mid=1&20OR%201%3D1? Answer: you execute the following query and your entire database is wiped out.

DELETE FROM medical_records WHERE mid = 1 OR 1=1;

Try using prepared statements instead:

<?php
include("functions/init.php");
if (isset($_GET['mid'])) {
    $sql = "DELETE FROM medical_records WHERE mid = ?";
    $stmt = $con->prepare($sql);
    $stmt->bind_param("i", $_GET["mid"]);
    if ($stmt->execute()) {
        echo "Fisa a fost stearsa.";
    } else {
        echo "Error: $stmt->error";
    }
}

score -1 · Answer 2 · answered Apr 08 '17 at 22:29

-1

Use mysqli_affected_rows to check whether DELETE query worked or not.

Example (from php.net)

<?php
$link = mysqli_connect("localhost", "my_user", "my_password", "world");

if (!$link) {
    printf("Can't connect to localhost. Error: %s\n", mysqli_connect_error());
    exit();
}

/* Insert rows */
mysqli_query($link, "CREATE TABLE Language SELECT * from CountryLanguage");
printf("Affected rows (INSERT): %d\n", mysqli_affected_rows($link));

mysqli_query($link, "ALTER TABLE Language ADD Status int default 0");

/* update rows */
mysqli_query($link, "UPDATE Language SET Status=1 WHERE Percentage > 50");
printf("Affected rows (UPDATE): %d\n", mysqli_affected_rows($link));

/* delete rows */
mysqli_query($link, "DELETE FROM Language WHERE Percentage < 50");
printf("Affected rows (DELETE): %d\n", mysqli_affected_rows($link));

/* select all rows */
$result = mysqli_query($link, "SELECT CountryCode FROM Language");
printf("Affected rows (SELECT): %d\n", mysqli_affected_rows($link));

mysqli_free_result($result);

/* Delete table Language */
mysqli_query($link, "DROP TABLE Language");

/* close connection */
mysqli_close($link);
?>

Reference http://php.net/manual/en/mysqli.affected-rows.php

answered Apr 08 '17 at 22:29

Hamza Rashid

1,329
15
22

The PHP part of the delate operation works, it worked before the ajax part. – Razvan Zamfir Apr 08 '17 at 22:30
Comment redirect header and inspect element to see if you still get `
...
` tag on the `delete_record.php` page? – Hamza Rashid Apr 08 '17 at 22:35
Ok, include("functions/init.php"); was missing from the top of delete_record.php (it was "normaly" included in header.php, wich I excluded from delete_record.php) – Razvan Zamfir Apr 08 '17 at 22:43
But there is one more thing: the records_all.php file (displays all the records) does not update (render again) unlsess I refres the page. I use Data Tables ton display the records nicely. – Razvan Zamfir Apr 08 '17 at 22:45
using `AJAX` the page doesn't refresh automatically. – Hamza Rashid Apr 08 '17 at 22:47
you need to write some simple JS code to delete this row from table also after it is deleted on DB. – Hamza Rashid Apr 08 '17 at 22:48
Let us [continue this discussion in chat](http://chat.stackoverflow.com/rooms/141256/discussion-between-razvan-zamfir-and-hamza-rashid). – Razvan Zamfir Apr 08 '17 at 22:55

Php CRUD app: using Ajax to delete row returns an entire page

2 Answers2