Question

I am doing a really simple script to delete a row out of a database. I have done it before with almost identical code but for some reason this wont work!

Viewmessages.php has no problem running but when I try and delete the row using deletemessage.php I receive the an sql error, I only have one line of sql:

viewmessage (sending info to deletemessage.php):

echo "<a href='deletemessage.php?contactname=".$contactname."'>Delete</a>";

The following is the delete message code:

<?php
session_start();
if ( !isset($_SESSION['adminusername']))
{
header("Location:admin.php");
exit();
}


require "dbconn.php";

$contactname = $_GET['contactname'];

$query = "DELETE FROM message WHERE contactname =".$contactname;

$results = mysql_query($query) or die(mysql_error());

header("Location: viewmessages.php");
?>

I cant work out what the error is! $contactname in the viewmessages.php file definately speaks of the primary key for the table!

Any Ideas?>

EDIT: I know that the problem lies with the contactname in the sql… for some reason it is not recieving it well, I did an echo to see what it thought the contactname was and it was correct. I then changed the variable and put in a string of one values in contactname and it deleted the row correctly… so the problem is the GET_[‘contactname’] but I am not sure what….

Answer 1

Enclose $contactname in quotes in the query, since it is a string. But escape it first! It is highly vulnerable to SQL injection the way it is now. I understand it may be an administrative page, but it is a very good habit to always observe, even when your users are trusted. (Especially since Mr O'Malley would break the SQL statement when you tried to delete him)

$concatname = mysql_real_escape_string($_GET['contactname']);
$query = "DELETE FROM message WHERE contactname ='".$contactname . "'";

Always beware when deleting via a hyperlink. Looks like you are checking for admin privileges before allowing this to execute, but be sure these links are not accessible to the broad Internet, where they might get crawled.