Question

I can not seem to figure out what I’m missing could you all give me some help?

function deleteFile(file){

var file = encodeURIComponent(file);


if (window.XMLHttpRequest) {// code for IE7+, Firefox, Chrome, Opera, Safari
xmlhttp=new XMLHttpRequest();
} else {// code for IE6, IE5
xmlhttp=new ActiveXObject("Microsoft.XMLHTTP");
}

xmlhttp.onreadystatechange=function() {
if (xmlhttp.readyState==4 && xmlhttp.status==200) {
document.getElementById("media").innerHTML=xmlhttp.responseText;
}
}
xmlhttp.open("GET", "http://www.bennettauto.biz/file-tree-hr/delete.php?file=\""+file, true);
xmlhttp.send();
alert(clicked);
}

HTML:

 <div id='TrashFile'><a href="javascript:void(0)"onClick='deleteFile(<? echo $deletefile; ?>);'><img src='http://www.bennettauto.biz/images/tool_trash.gif'></a></div>

delete.php:

<?php
    // I save the file sources from the URL what was sent by AJAX to these variables.
    $file = $_GET['file'];


    function deleteFiles($id){
        // If is a file then delete the file.
        if(is_file($id)){
            return unlink($id);
        // Else show error.
        } else {
            echo $id . " is not a file, or there is a problem with it.<br />" ; 
        }
    }

    if(isset($file)){
        deleteFiles($file);
    }


 ?>

The onClick function does not seem to be calling delete.php, there is something I’m missing but I can’t see what.

Answer 1

xmlhttp.open(“GET”, “http://www.bennettauto.biz/file-tree-hr/delete.php?file=\””+file, true);

What’s that \" doing there? I don’t see a matching quotation mark for that. When sending info using GET you should not include quotation marks.

And on a more general note, this is very dangerous code, I’m assuming that this is for an Admin but I don’t see any authorization checks in delete.php. At least check if the user is logged in etc.