Trying to delete a file with Ajax

Question

My script is not working.

"sb-pdfs/" is the path where the file is located that I want to delete. If I substitute the $_GET part with the correct file name and call the php scripts directly, then the file is in fact deleted, but not when I try to do it with the Ajax function. I could also just substitute the php with a simple echo which is not called either.

<?php 

unlink ('sb-pdfs/'+($_GET['file']));
   
?>

So the error seems to be on the AJAX side:

  function loeschen(clicked_id)
  {
      alert(clicked_id);
        
      $.ajax({
          url: 'unlink.php',
          data: {'file' : clicked_id },
          success: function (response) {
             if( response.status === true ) {
                 alert('File Deleted!');
             }
             else alert('Did not work!');
          }
        });

    }

I get the correct clicked_id alert, but also the "Did not work!" alert and the file is not deleted.

Edit: clicked_id is the filename of the file I want to delete.

Quite obviously because `response.status` is not equal to `true`; it's probably equal to `"true"`. Try logging it? — Jeremy Thille, Apr 26 '21 at 14:45
You should not do something like delete a file on your server with a GET request. — Pointy, Apr 26 '21 at 14:45
@JeremyThille Ok. And why is that or what do I need to do to make it true? — Coffeehouse, Apr 26 '21 at 14:47
I don't know, you wrote your PHP code, so you know what it returns. We don't :) — Jeremy Thille, Apr 26 '21 at 14:48
@Pointy It is not a public site, the site will be accessible only by one person. — Coffeehouse, Apr 26 '21 at 14:48
@JeremyThille I do not even know what the response.status is for; I just want to delete a file on the server. — Coffeehouse, Apr 26 '21 at 14:49
I'm not sure what you send as "clicked_id", is it a filename ? is it some kind of other identifier ? — Victor bvn, Apr 26 '21 at 14:49
`response` is what your PHP file sends back. Apparently it's not returning anything, so `response===""` or maybe `response===undefined` (I haven't touched PHP in ages so I'm not sure). Anyway what I'm sure of is that `response.status` is undefined. It can't be `true`, therefore you always get `'Did not work!'`. — Jeremy Thille, Apr 26 '21 at 14:56

score 2 · Answer 1 · answered Apr 26 '21 at 14:54

Your string concatenation is incorrect, you need to use dots . in PHP


unlink ('sb-pdfs/' . ($_GET['file']));
   
?>

As other users have pointed it out, it would be a big security issue as it stands, I would advise a lot of parsing or using an ID system instead of filenames

Trying to delete a file with Ajax

1 Answers1