Question

I am trying to delete multiple records using check boxes. I’ve loaded each check box with the record ID:

<?php $row_count = 1; do {  ?>
    <tr <?php if ($row_count%2) { ?>bgcolor="#F4F4F4"<?php } ?>>
      <td align="center" ><input name="checkbox[]" type="checkbox" id="checkbox[]" value="<?php echo $row_contactlist['contact_id']; ?>"></td>
      <td align="center" ><p><?php echo $row_contactlist['contact_id'];?></p></td>
    </tr>
    <?php $row_count++; } while ($row_contactlist = mysql_fetch_assoc($contactlist)); ?>

I’m running the delete using the following link:

<a class="addcontact" href="delete.php?mContact=<?php for($i=0;$i<=$row_count;$i++) { $del_id = $checkbox[$i]; } echo $del_id ?>" style="border-bottom:0px" >Delete Contact(s)</a>  

that runs delete.php

if (isset($_GET['mContact'])) {
mysql_query("DELETE FROM contacts WHERE contact_id = ".$_GET['mContact']."");
mysql_query("DELETE FROM history WHERE history_contact = ".$_GET['mContact']."");
mysql_query("DELETE FROM notes WHERE note_contact = ".$_GET['mContact']."");
redirect('You have deleted some contacts',"contacts.php");
}

The redirect works i.e. the contacts page reloads with ‘you have deleted some contacts’ and it looks like I get no errors, but none of the contacts are deleted.

UPDATE:
Thanks guys very speedy response. Total newb to PHP so everything is massively appreciated.

So I’ll use a sumbit button not a hyperlink:

<td colspan="5" align="center" bgcolor="#FFFFFF"><input name="delete" type="submit" id="delete" value="Delete"></td>

Answer 1

I believe you’re having a mixup dealing with the selection of the criteria to be deleted.

The link that takes the user to the delete page has nothing to do with the checkboxes in the code.

I believe what you want to do is

1. Create the checkboxes (and if you want something to be deleted by default, set checked="checked"
2. Change the <a href..> to a submit button
3. In the delete.php the checkboxes will be in an array $_GET['checkboxes'], which you can iterate through

NOW, onto the issues that @JohnP alluded to:

1. This is pretty insecure way to do this unless you have removed all your validation code before posting here.
2. I would recommend passing everything by $_POST for a little bit more security through obscurity
3. Check that the user has the privileges to delete the rows that they are attempting to delete.
4. Set a LIMIT 1 on each delete (or update) query so you don’t accidentally delete all the rows in your database.

UPDATE

If you want to have a single delete link, you would need to add the link inside the do...while loop. It appears that you have the link outside that loop and you loop through every result and add them all to the mContact token. As a single, long string of numbers, your handling script does not have a way of parsing that information without delimiters.