在SQL中删除类型为varchar的行的问题

Question

I am trying to create a form that will delete a row in a table based on the attribute a user selects from a drop down list of options. For some reason the first option, (attemptid) which is an int, works, but the other three (which are varchar) do not. The error handling I have set up to debug the script is returning 1 or true , but the row in question is not deleted.

HELP! I have tried everything but am only just learning PHP so imagine I am missing something quite simple.

require_once("settings.php");
$conn = @mysqli_connect($host, $user, $pass, $db);
if ($conn) {
?>
   <form method="post" action="delete_attempts.php" name="delete_attempts" id="delete_attempts" >
      <label for="deleteby">
      <p>Select an option to delete results by:</p>
      </label>
      <select name="deleteby">
      <option value="attemptid">Attempt ID</option>
      <option value="firstname">First Name</option>
      <option value="lastname">Last Name</option>
      <option value="studentid">Student ID</option>
      </select>
      <p></p>
      <input type="text" name="delvalue" placeholder="Value">
      <div>
        <input type="submit" value="Delete Record" id="submit" />
      </div>
    </form>
    <?php
    if (isset($_POST["delvalue"])) {
       // get value from form
       $delValue = trim($_POST["delvalue"]);
       echo $delValue;
        // queries to delete record
       $queryAttemptId = "DELETE FROM quizattempts WHERE attemptid = '$delValue'";
        $queryFirstName = "DELETE FROM quizattempts WHERE firstname = '$delValue'";
        $queryLastName = "DELETE FROM quizattempts WHERE lastname = '$delValue'";
        $queryStudentId = "DELETE FROM quizattempts WHERE studentid = '$delValue'";


       //select which value to search for
        if ($_POST["deleteby"] = "attemptid")   {
             // pass query to database
            $result   = mysqli_query($conn, $queryAttemptId);
        } // end delete attemptid
        else if ($_POST["deleteby"] = "firstname")   {
             // pass query to database
            $result   = mysqli_query($conn, $queryFirstName);
        } // end delete firstname
        else if ($_POST["deleteby"] = "lastname")   {
             // pass query to database
            $result   = mysqli_query($conn, $queryLastName);
        } // end delete lastname
        else if ($_POST["deleteby"] = "studentid")   {
             // pass query to database
            $result   = mysqli_query($conn, $queryStudentId);
        } // end delete student id

        echo  "this is the result $result";

        // if query is successful are found
        if ($result) {
            echo "<p>Delete operation successful</p>";
        } // end if result found
        else {
            // if no record is found in DB
            echo "<p>No records found</p>";
        } // end if no result found
    } //isset($_POST["attemptid"])
} //$conn

?>

Answer 1

        if ($_POST["deleteby"] = "attemptid")   {

That should be == . Your code as written will assign "attemptid" to $_POST["deleteby"] and then return the same value... which is always true. So your other else if s are never even checked.

Also, your code as written is vulnerable to SQL injection . You're already using mysqli; you should strongly consider using prepared statements .