Question

I use a form where i have listed the data from database like title, date etc. from the database and using checkboxes i use the multiple delete operation

For example my code look like this

<form method="post" action="action.php">
<input name="checkbox[]" type="checkbox" id="checkbox[]" value="<?php echo $row['id']; ?>"/>
<input name="delete" type="submit" id="delete" value="Delete"/>

and in the action.php the code is like this

 $checkbox = $_POST['checkbox'];
    //count the number of selected checkboxes in an array
    $count = count($checkbox);
    //Create a for loop to delete 
    for($i=0;$i<$count;$i++)   {
    $del_id = $checkbox[$i];
    $sql = "DELETE FROM news WHERE id='$del_id'";
    $result_delete_data = mysql_query($sql);
    }

Now the table i want to delete actually have 5 table entities like title, timestamp,pic_title,pic_brief,pic_detail the last three entities i.e pic_title, pic_brief and pic_detail is actually storing the path of the image for example the value stored in one of the 3 entity would look like this upload/file/pic_title1.jpg

My problem is when i run my first for loop it successfully deletes the table without any problem but the file which exist in the file directory remains intact. i want to delete that file too, to remove that file i thought of adding another for loop which i did something like this

for($j=0;$j<$count;$j++){
        $delete_id = $checkbox[$j];
        $query = "SELECT news.pic_title, news.pic_brief, news.pic_detail FROM news WHERE id = '$delete_id'";
        $result = mysql_query($query);
        $row = mysql_fetch_array($result);
        unlink($row['pic_title']);
        unlink($row['pic_brief']);
        unlink($row['pic_detail']);
        }

The above code is unable to delete the requested file, my Query string is perfectly working fine i tested it by removing the unlink function and printing the values, it prints all the selected value , but it is refusing to delete the file and when i try to run the loop it shows error in the last three line, while i am pretty sure that, $row[‘pic_title’], $row[‘pic_brief’], $row[‘pic_brief’], have the full path of the image.

    unlink($row['pic_title']);
    unlink($row['pic_brief']);
    unlink($row['pic_brief']);

where i am going wrong?

P.S: There is nothing wrong with file permission because when i individually try to run the function unlink it deletes the file from the same directory.

EDIT : This is the error message i get

Warning: unlink() [function.unlink]: No error in C:\wamp\www\bn\admin-login\action.php on line 580

Warning: unlink() [function.unlink]: No error in C:\wamp\www\bn\admin-login\action.php on line 581

Warning: unlink() [function.unlink]: No error in C:\wamp\www\bn\admin-login\action.php on line 582

To be more precise i tested this function individually in php and it is working perfectly fine

$target = 'upload/file/file1.jpg';
unlink($target);

and for this reason i dont think the file permission is causing the error, i guess i am going wrong somewhere with the logic.

@Lekensteyn got me the solution, thank you Lekensteyn.

actually i had to first hold the value in a variable and then unlink the file. the working code looks like this.

 for($j=0;$j<$count;$j++){
        $delete_id = $checkbox[$j];
        $query = "SELECT * FROM news WHERE id = '$delete_id'";
        $result = mysql_query($query);
        $row = mysql_fetch_array($result);
        $pic_title = $row['pic_title'];
        $pic_brief = $row['pic_brief'];
        $pic_detail = $row['pic_detail'];
        unlink($pic_title);
        unlink($pic_brief);
        unlink($pic_detail);
        }

Answer 1

It could be file permissions. You need to be the owner of the file in order to delete it.

Some hosters run the website under the user ‘apache’ (or similar), but the files are owned by the ftpuser (accountxxxx for example).

Check the current working dir too, with echo getcwd() if the paths not absolute.

Your script is vulnerable to SQL injection too, a post request with checkbox[]='||1||' deletes everything.