Question

Sorry, I’m not sure how to really word my question. Here it goes.

If you go to my page http://www.eveo.org/stack/view.php you will notice on the right hand side there are links that read “restore” and “delete”. If it says restore, the value for the “deleted” table in the database is “y”.

The problem: When I click on a link, all of them change, not just the one. What I need to do is when I click on “delete” or “restore” on any of them, only that row will delete and restore and only will that rows link update, with all the others staying the same. The value in the database has to change from “y” to “n” or vice versa depending on the link.

The code that currently changes my link for all of them is:

echo "<td><a href='view.php?'>";

    $y="$row[deleted]";
    $x="$row[id]";

    if ($y == 'n'){
        mysql_query("UPDATE inventory SET deleted = 'y' WHERE id='$row[id]'");
        echo "delete";
    }
    else if ($y == 'y'){
        mysql_query("UPDATE inventory SET deleted = 'n' WHERE id='$row[id]'");
        echo "restore";
    }

echo"</a></td>";

I’ve been trying to solve this for hours, and it’s not working.

Requirements: It has to use URL rewriting, so I can’t do this change thing with javascript or something, personally I would have, but these are my professors requirements.

Source code:

VIEW.PHP

<?php { ?>
    <table border="0" cellpadding="0" cellspacing="0" id="table">
        <thead>
            <tr>
                <th>ID</th>
                <th>NAME</th>
                <th>MANUFACTURER</th>
                <th>MODEL</th>
                <th>DESCRIPTION</th>
                <th>ON HAND</th>
                <th>REORDER</th>
                <th>COST</th>
                <th>PRICE</th>
                <th>SALE</th>
                <th>DISCOUNT</th>
                <th>DELETE</th>
            </tr>
        </thead>
        <tbody>
            <?php } ?>
                <?php

                    // while($r = mysql_fetch_array($resultDeleted)) 
                    // {
                        // echo $r[0];
                    // }

                ?>
                <?php while($row = mysql_fetch_array($result)) {

                    echo "<tr>";
                    echo "<td>$row[id]</td>";
                    echo "<td>$row[name]</td>";
                    echo "<td>$row[manufac]</td>";
                    echo "<td>$row[model]</td>";
                    echo "<td>$row[descrip]</td>";
                    echo "<td>$row[onhand]</td>";
                    echo "<td>$row[reorder]</td>";
                    echo "<td>$row[cost]</td>";
                    echo "<td>$row[price]</td>";
                    echo "<td>$row[sale]</td>";
                    echo "<td>$row[discont]</td>";
                    echo "<td><a href='view.php?'>";

                        $y=$row[deleted];
                        $x=$row[id];

                        if ($y == 'n'){
                            mysql_query("UPDATE inventory SET deleted = 'y' WHERE id='$row[id]'");
                            echo "delete";
                        }
                        else if ($y == 'y'){
                            mysql_query("UPDATE inventory SET deleted = 'n' WHERE id='$row[id]'");
                            echo "restore";
                        }

                    echo"</a></td>";
                    echo "</tr>";
                } ?>
            <?php { ?>
        </tbody>
    </table>
<?php } ?>

Answer 1

It looks like you are trying to get a $_GET variable using the code:

$y="$row[deleted]";
$x="$row[id]";

This is never going to work. First of all you don’t need to add double quotes around your variables. Second the correct syntax for getting the $_GET variables is:

$delete = $_GET['delete'];
$id = $_GET['id'];

As you can see I have given your variable names better descriptive names.

Second, when you are just adding those variables to a query you will have a huge SQL injection hole in your application:

mysql_query("UPDATE inventory SET deleted = 'y' WHERE id='$id'");

What if I was a hacker I would add an id of: 1' or 1=1, which would result in the following query:

UPDATE inventory SET deleted = 'y' WHERE id='1' OR 1=1

And suddenly I set the deleted status of all records in the table. I could even get into others tables using this attack in do whatever I want.

So you should always use mysql_real_escape_string():

$id = mysql_real_escape_string($_GET['id']);

mysql_query("UPDATE inventory SET deleted = 'y' WHERE id='$id'");

So what you will get is the following:

$delete = mysql_real_escape_string($_GET['delete']);
$id = mysql_real_escape_string($_GET['id']);

mysql_query("UPDATE inventory SET deleted = '$delete' WHERE id='$id'");

Another thing is that you don’t need to keep opening and closing the PHP tags. Only if you want to add some HTML.

Next:

instead of echoing all that stuff simply use HEREDOC:

So instead of doing:

                echo "<tr>";
                echo "<td>$row[id]</td>";
                echo "<td>$row[name]</td>";
                echo "<td>$row[manufac]</td>";
                echo "<td>$row[model]</td>";
                echo "<td>$row[descrip]</td>";
                echo "<td>$row[onhand]</td>";
                echo "<td>$row[reorder]</td>";
                echo "<td>$row[cost]</td>";
                echo "<td>$row[price]</td>";
                echo "<td>$row[sale]</td>";
                echo "<td>$row[discont]</td>";
                echo "<td><a href='view.php?'>";

You can simply do:

echo <<<HTML
<tr>
<td>{$row['id']}</td>
<td>{$row['name']}</td>
etc
FOOBAR;

As you can see it need quotes to get an array element.

After that you should build your links:

$delete = 'n';
if ($row['deleted'] == 'n') {
    $delete = 'y';
}
echo '<a href="view.php?id=' . $row['id'] . '&delete=' . $delete . '">delete</a>';

As a general note:

ALWAYS ENABLE FULL ERROR REPORTING ON DEV ENVIRONMENT so you can see what the f*&k is going on / wrong. So place this at the top of your scripts:

error_reporting(E_ALL | E_STRICT);
ini_set('display_errors', 1);