CODEWITHSUNDEEP
phpmysql
Jahed Hussain
Jahed Hussain

Reputation: 183

PHP ID not going through url

i cannot get a row to delete as the id is not going through the url. its a simple error somewhere and i cannot find the solution after having a look around for an hour.

this page contains the information on a table:

    <?php

$result = mysql_query("SELECT review, ratings, date, user FROM reviews")
or die(mysql_error()); ;

if (mysql_num_rows($result) == 0) {
       echo 'There Arent Any Reviews Yet';
    } else {

echo "<table border='0'><table width=100% border='6'><tr><th>Comments/Thoughts</th><th>Ratings</th><th>Date</th><th>User</th><th>Delete</th></tr>";
while($info = mysql_fetch_array($result))
{
        echo "<tr>";
        echo "<td>" . $info['review']. "</td>";
        echo "<td>" . $info['ratings']. " Stars</td>";
        echo "<td>" . $info['date']. "</td>";
        echo "<td>" . $info['user']. "</td>";

        echo "<td>" . " <a href='deletereview.php?review_id=" . $info['review_id'] . "'>Delete</a> </td>";
        echo "</tr>";
        }
    }
echo "</table>";
?>

it goes to deletereview.php which carries out the delete function:

    <?php
session_start();
require_once '../includes/db.php';  
$id = $_GET['review_id'];

$info = "DELETE FROM reviews WHERE review_id = '$id'";

mysql_query($info) or die ("Error: ".mysql_error());
echo "<h2>Review Deleted</h2>";

?>

any ideas guys?

Upvotes: 1

Views: 125

Answers (5)

3s73ban
3s73ban

Reputation: 31

You have to select the review_id in the query. But also you have to check for some SQL injection, because with the GET request it's easy to delete all the table records.

Upvotes: 0

Blender
Blender

Reputation: 298186

Aside from the other answers, I'll say this:

Your database will get jacked if you do not sanitize your variables.

For instance, what happens if I pass review_id=' OR '1'='1?

DELETE FROM reviews WHERE review_id = '' OR '1'='1'

This query will delete everything in reviews.

mysql_real_escape_string() your $_GET and $_POST variables before using them in your MySQL.

Upvotes: 3

Clive
Clive

Reputation: 36956

You're not selecting review_id from the database but you use $info['review_id'] to set the ID on the URL. Just change your first line to:

$result = mysql_query("SELECT review_id, review, ratings, date, user FROM reviews")

Also you must escape the input with mysql_real_escape_string:

$id = mysql_real_escape_string($_GET['review_id']);

Upvotes: 0

tpae
tpae

Reputation: 6346

You forgot to select the review_id.

$result = mysql_query("SELECT review_id, review, ratings, date, user FROM reviews")

Upvotes: 2

James
James

Reputation: 8586

You're not selecting the review_id in the query, so $info["review_id"] is always null.

Upvotes: 7

Related Questions