Search code examples
phpmysqldatabasesql-delete

mySQL - Can't delete table row with PHP (not showing an error)


I've spent today going through tons of similar questions and trying to figure out what is wrong with my code, lots of issues people had with back ticks, quotes, etc but none seem to help or change my cause. My code is no producing any errors, but when I use echo to print out my query results, it seems that the id is not getting a value.

In my delete.php:

<?
ini_set('display_errors',"1");

$username="xxx";
$password="xxx";
$database="xxx";

$conn = new mysqli(localhost, $username, $password, $database);

if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

$id = (int)$_GET['number'];
mysqli_query($conn,"DELETE FROM tourdates WHERE id=".$id."");

$conn->close();

?>

And the delete button in my main.php (the rest of the php is correctly displaying my table with data):

<td><a href='delete.php?number='".$row['id']."'>Delete</a></td>

Can someone help pick out what is causing my rows not to delete when I hit the delete button that I have created, or maybe something that more clearly can help me debug? (I don't want to use checkboxes for this).

EDIT:

I also tried this code (while defining the function as $sql and I'm getting a "Success" message:

if ($conn->query($sql) === TRUE) {
    echo "New record created successfully";
} else {
    echo "Error: " . $sql . "<br>" . $conn->error;
}

EDIT 2:

I changed the structure following the advice that I should use POST, thinking I might have caught something I didn't notice before, but still not working.

echo "<td><form method='post' action='delete.php'>
        <input type='hidden' name='row_id' value=".$row['id']."  />
        <input type='submit' name='delete_row' />
        </form>";

-

if(isset($_POST['delete_row'])) {
    $stmt = $conn->prepare("DELETE FROM tourdates WHERE ID = ?");
    $stmt->bind_param('i', $_REQUEST['row_id']);
    $stmt->execute();
}

If I do it the above way, nothing happens. Also tried this way, and get a syntax error:

if(isset($_POST['delete_row'])) {
    $id = $_POST['row_id'];
    $sql = "DELETE FROM tourdates WHERE id=".$id;
    mysqli_query($conn,$sql);
}

Solution

  • A potential problem that I can see, is that you are not quoting localhost so php will look for a constant called localhost:

    $conn = new mysqli('localhost', $username, $password, $database);
                       ^         ^ here
    

    You are also not checking for errors so that is why you don't see any. The easiest way to fix that, is to have mysqli throw exceptions. Just add this to the top of your script:

    mysqli_report(MYSQLI_REPORT_STRICT);
    

    I also don't know if you can mix procedural and object oriented mysqli like that. You should probably stick to the OOP version.

    Apart from that you should not use a link (GET request) for your delete actions. What if a web-crawler or a browser extension tries to fetch the links? Instead you should use a POST request (like a form with a button).

    Edit: There is another problem which causes you not to get your ID and as you cast it to int, you will always get 0:

    <td><a href='delete.php?number='".$row['id']."'>Delete</a></td>
                                   ^ Oooops, closing the href attribute value here...
    

    Your id gets placed after the value / outside of the quote of the href value. You can easily verify this if you look at the source of your page.

    You need:

    <td><a href='delete.php?number=".$row['id']."'>Delete</a></td>