Question

Hello I’m a newbie web programmer.
My background is writing Windows applications with sql.

I’m putting together my 1st data entry screens in Php.

I have a search form that links to a form that displays records in a grid.
On each row of the grid I have a delete url to allow the user to remove a record.
This links to a form delete.php (which calls the sql to remove the record).

Ideally I would like to automatically take the user back to the search form rather than forcing the user to click on a link to do so.

I have used ob_start with the header to do this elsewhere but cannot get it to work on this page.
Is there another way to do it?

(Using php 5 as part of LAMP)
file delete.php

<?php 
$id = $_GET['recordID'];
//ob_start();
require_once('connections/local.php'); 

mysql_select_db($database_local, $local);

mysql_query("DELETE FROM user_access WHERE id = {$id}") or die(mysql_error());
echo("Record ".$id." deleted");
echo("<br>");
//header("location:http://localhost/search7.htm);
//ob_flush();
echo("<a href=\"http://localhost/search7.htm\">Search for Members</a>");

?>

Answer 1

When you send a Location header, there’s no reason to echo anything to the browser, so you might as well exit() immediately:

<?php 
$id = mysql_real_escape_string($_GET['recordID']);
require_once('connections/local.php'); 
mysql_select_db($database_local, $local);

mysql_query("DELETE FROM user_access WHERE id = '$id'") or die(mysql_error());

header("Location: http://localhost/search7.htm");
exit();
?>

IMPORTANT: You are also vulnerable to SQL injection (fixed above via mysql_real_escape_string)