Question

I have the following DELETE function i’ve tried to write by hand, from what I’ve learnt so far, however it doesnt seem to be working and I cant find anything online to see where im going wrong, can anybody see obvious errors?

<?php 
if(isset($_POST['int1'])) { 
    $interest = $_POST['int1']; 
    mysql_query = ("DELETE $interest FROM user_interests WHERE user_id = ". $usersClass->userID();
}
elseif(isset($_POST['int2'])) {
    $interest = $_POST['int2']; 
    mysql_query = ("DELETE $interest FROM user_interests WHERE user_id = ". $usersClass->userID();
} 
elseif(isset($_POST['int3'])) {
    $interest = $_POST['int3']; 
    mysql_query = ("DELETE $interest FROM user_interests WHERE user_id = ". $usersClass->userID();
}

print $interest1 . "<form method='post' action='#'><input type='hidden' value='".$interest1."' name='int1' id='int1'/><input type='submit' value='delete' /></form><br />";
print $interest2 . "<form method='post' action='#'><input type='hidden' value='".$interest2."' name='int2' id='int2'/><input type='submit' value='delete' /></form><br />";
print $interest3 . "<form method='post' action='#'><input type='hidden' value='".$interest3."' name='int3' id='int3'/><input type='submit' value='delete' /></form><br />";
?>

---

Now trying this with no luck…

    <?php 
    if(isset($_POST['int1'])) { 
        $interest = $_POST['int1']; 
        $qResult= mysql_query("UPDATE user_interests SET interest = null WHERE interest = $interest and user_id = ". mysql_real_escape_string($usersClass->userID()));
    }
    elseif(isset($_POST['int2'])) {
        $interest = $_POST['int2']; 
        $qResult= mysql_query("UPDATE user_interests SET interest = null WHERE interest = $interest and user_id = ". mysql_real_escape_string($usersClass->userID()));
    } 
    elseif(isset($_POST['int3'])) {
        $interest = $_POST['int3']; 
        $qResult= mysql_query("UPDATE user_interests SET interest = null WHERE interest = $interest and user_id = ". mysql_real_escape_string($usersClass->userID()));
    }

    print $interest1 . "<form method='post' action='#'><input type='hidden' value='".$interest1."' name='int1' id='int1'/><input type='submit' value='delete' /></form><br />";
    print $interest2 . "<form method='post' action='#'><input type='hidden' value='".$interest2."' name='int2' id='int2'/><input type='submit' value='delete' /></form><br />";
    print $interest3 . "<form method='post' action='#'><input type='hidden' value='".$interest3."' name='int3' id='int3'/><input type='submit' value='delete' /></form><br />";
    ?>

Answer 1

You can’t do mysql_query =, as mysql_query() is a function. Try this instead:

$qResult= mysql_query("DELETE " . mysql_real_escape_string($interest) . "FROM user_interests WHERE user_id = " . mysql_real_escape_string($usersClass->userID()));

Plus, you’re wide open to SQL injection. You should consider using PDO with prepared queries to avoid this issue. At a minimum, use mysql_real_escape_string() as I show you here.