MySQL删除查询在灯泡堆栈上不起作用

Question

I am doing a project work on php. During my work every single query work smoothly. But when I want to delete any object using it won't delete ...

Here's my php code

<?php
//delete item
if(isset($_GET['deletecat'])){
    $id_to_delete = $_GET['deletecat'];
    $sql = mysql_query("DELETE FROM `category` WHERE `Category_id`=$id_to_delete LIMIT 1") or die('Error: Could not delete.');
    }
    else{
    header('location: category.php');
    exit();
    }       
?>

and after that I only get the error message. GET value is OK. And on my phpmyadmin this SQL running OK. But there's a pop up message appear when I want to delete any object. what can I do now?

Answer 1

You should escape the GET variable first to avoid any SQl injection attacks as already said by deceze. Then, you should understand that the message given by phpmyadmin is a confirmation if you need to execute the delete query. you can use mysql_real_escape_string($value) to escape but as php vendor says, this function will be removed very soon and is currently deprecated. bye..

Answer 2

there's a few layers where you could be having issues: with the db connection, the query, or the data which you are sending.

also, you are not filtering for " and ' marks so you could be in trouble there, and you're not ensuring that your id is a number so your sql could also be failing there.

but, you can figure that out with a few adjustments to your code.... you can insert some diagnostics into your code to see what mysql is reporting the error as and get a better idea of how to fix it.

note that it is [generally recommended][1] to use mysqli extension instead of mysql extension, but irregardless, here's sample code with the extension you are currently using

hope this helps!

<?php

    if ( isset($_GET['deletecat'])) {

        #dbh -> database resource. 
        $dbh = mysql_connect()

        #mysql_connect returns false if it fails. capture error and echo to output.
        if (!$dbh) {
            die("Could not connect to database server: ".mysql_error()."\n");
            #if using mysqli use mysql_connect_error() instead
        }

        #never trust input. use an escape function.    
        $id_to_delete = mysql_real_escape_string($_GET['deletecat'],$dbh);

        #force $id_to_delete to be treated as a number, or make it safer in your sql. 
        #i used the latter method below.
        $sql = "DELETE FROM `category` WHERE `Category_id` = '$id_to_delete' LIMIT 1");

        #mysql_query returns false on failure
        $result = mysql_query($sql,$dbh);

        #on failure catch the error and display the exact contents of 'deletecat' in a web-friendly way.
        if (!$result) {
            $error=mysql_error($dbh);
            die ("Error: Could not delete '"
                 .htmlentities(print_r($_GET['deletecat'],true)).". Error: $error\n"
            );

       }

       #if we did not trigger die() above we are ok.
       header('location: category.php');
       exit();
    }
?>

:

[1]: see warning at http://php.net/manual/en/function.mysql-connect.php