PHP I can't delete uploaded file

Question

This is my upload page, it will also show the uploaded file in that page. Everytime I press delete, wont get me to delete.php?id=7 . It will be like delete.php?id= < .

Can I know whats the problem?

<div id="content">
<form method="post" enctype="multipart/form-data">
<table width="350" border="0" cellpadding="1"
cellspacing="1" class="box">
<tr>
<td>Please select a file</td></tr>
<tr>
<td>
<input type="hidden" name="MAX_FILE_SIZE"
value="16000000">
<input name="userfile" type="file" id="userfile"> 
</td>
<td width="80"><input name="upload"
type="submit" class="box" id="upload" value=" Upload "></td>
</tr>
</table>
</form>
 <table>
<?php
 mysql_connect("localhost", "root", "") or die(mysql_error()) ; 
 mysql_select_db("test") or die(mysql_error()) ; 

$sqlquery=mysql_query("SELECT * FROM upload");

while(list($id, $name) = mysql_fetch_array($sqlquery)){
 echo "<tr>";
 echo "<td>".$id."</td>";
 echo "<td>".$name."</td>";
 echo "<td><a href='delete.php?id='".$id."'> delete</a></td>";
 echo "</tr>";
}
?>
</table>
<?php
if(isset($_POST['upload'])&&$_FILES['userfile']['size']>0)
{
$fileName = $_FILES['userfile']['name'];
$tmpName  = $_FILES['userfile']['tmp_name'];
$fileSize = $_FILES['userfile']['size'];
$fileType = $_FILES['userfile']['type'];
$fileType=(get_magic_quotes_gpc()==0 ? mysql_real_escape_string(
$_FILES['userfile']['type']) : mysql_real_escape_string(
stripslashes ($_FILES['userfile'])));
$fp      = fopen($tmpName, 'r');
$content = fread($fp, filesize($tmpName));
$content = addslashes($content);
fclose($fp);
if(!get_magic_quotes_gpc())
{
    $fileName = addslashes($fileName);
}
$con = mysql_connect('localhost', 'root', '') or die(mysql_error());
$db = mysql_select_db('test', $con);
if($db){
$query = "INSERT INTO upload (name, type, size, content ) ".
"VALUES ('$fileName', '$fileType', '$fileSize', '$content')";
mysql_query($query) or die('Error, query failed'); 
echo '<br/>File' .$fileName. ' uploaded';
mysql_close();
}else { echo "file upload failed";
    }
}
?>
</div>

and here is my delete.php

  <?php

    mysql_connect("localhost","root","")or
    die(mysql_error());
    mysql_select_db("test") or die(mysql_error());
    $sql="DELETE FROM upload WHERE id='$id'";
    $result=mysql_query($sql);
            if(isset($_GET['id'])) {
                $id=$_GET['id'];
                echo 'deleted successfully.';
                echo "<BR>";
                mysql_query("DELETE FROM staff WHERE id = $id");
            header("Location: student_upload.php");
        }else {
    echo "ERROR";   
    }
    ?>
    <?php
    mysql_close();
    ?>

Answer 1

Your problem is with quotes:

echo "<td><a href='delete.php?id='".$id."'> delete</a></td>";

If id is 7, the resulting HTML is:

<td><a href='delete.php?id='7'>delete</a></td>

Since the ' ends after = , the number never gets passed to the query string. It is just as if you wrote <a href="foo.html" hello there people>click me</a> .

To fix it, make sure your quotes are correctly nested:

echo '<td><a href="delete.php?id='.$id.'"> delete</a></td>';

Now your link is <td><a href="delete.php?id=7"> delete</a></td>