Question

I’ve spent hours on this one with no luck. I’m trying to delete list elements that have been marked with a check box and had a delete button press after. Each checkbox has an html id attribute that correlates the actual ID column value. I’m using the MySQL statement to remove rows based on the appropriate ids (I can remove the elements from the html but not the MySQL table)

"DELETE FROM todolist WHERE ID IN (".$_GET['id'].")"

example id… id=”456,444,454″

The javascript goes through and finds the id values of the checked boxes and sends them to a php file. This part is fine. From the alert, statement I can verify it’s giving the correct ids. Here’s the method called when the delete button is pressed.

function removeCheckedTask(){
var checkBoxes = $('toDoList').getElementsByClassName('box');
var deletedID = new Array(); var indexID =0;
for (var i = 0; i < checkBoxes.length; i++) {
  if (checkBoxes[i].checked){
        deletedID[indexID]=checkBoxes[i].getAttribute('id');indexID++;
        var par = checkBoxes[i].parentNode;
        $('toDoList').removeChild(par);
        i--;
        for(var a=i+1; a<checkBoxes.length; a++){//moves other elements
            par = checkBoxes[a].parentNode;
            par.style.top = (a*40)+"px";
        }
    }

}
if(deletedID.length>0){
    $('message').innerHTML = "Just a second..."
    // Set te random number to add to URL request
    nocache = Math.random();
    // Pass the login variables like URL variable
    var ids = 'id='+deletedID[0];
    for(var i=1; i<deletedID.length; i++){
        ids+= ',' + deletedID[i];
    }
    alert('removeTasks.php?'+ids);
    http.open('get', 'removeTasks.php?'+ids);
    http.onreadystatechange = deleteReply;
    http.send(null);
    }
    function deleteReply() {
    if(http.readyState == 4){ 
        var response = http.responseText;
        $('message').innerHTML = 'Task removed:'+response;
    }
}

resetIDs();//resets ids of list elements, don't worry about it

}

Here’s my php code without the connection stuff. It makes it into the is statement.

if(isset($_GET['id'])){
   $q+="DELETE FROM todolist WHERE ID IN (".$_GET['id'].")"; //line 13
   mysql_query($q) or die(mysql_error());
echo "tried to delete stuff";
} else { 
echo("Bad delete");
}

The response echo has been varying a bit as I’ve made changes to the $q string, but as of recently with this simple version it’s been printing the MySQL error-

Notice: Undefined variable: q in C:\xampp\htdocs\todo\removeTasks.php on line 13
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘0’ at line 1. How is getting into the if statement and then saying it’s undefined?

If I use

"DELETE FROM todolist WHERE ID IN ("+$_GET['id']+")"

I get the error- Notice: Undefined variable: q in C:\xampp\htdocs\todo\removeTasks.php on line 13
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘457’ at line 1.

457 was the first id.

New around here and to mysql, so let me know if I left anything out.

Answer 1

You get a notice because your variable “q” wasn’t defined and you try to add something to it. And you get an sql error because “+” is for numbers in php unlike in javascript. So your sql statement probably gets converted to a zero, and thats why you get the “0” error. The correnct way would be:

$q .= "DELETE...";

Also I would rather recommend calling each query separately since then you can get back the result (or the error) of each:

 $q = null;
 $ids = explode(",",$_GET["id"]);
 foreach($ids as $id) {
      $id = (int)$id; //VERY basic security thing
      $q = "DELETE FROM todolist WHERE ID = ".$id;
      mysql_query($q) or die(mysql_error());
 }

Are you learning php or is it an actual application? Because as someone said earlier this is not a good way to do this. GET shouldn’t be used for anything which has permanent changes on your data. You should have a POST form and some hidden field to check if the request actually came from that form.
And you should use mysql escape functions since anything could be inserted after your query. Look up mysql injections for more info.

Good luck