Member Avatar for gopi kannan

in my page i allow the administrator to list all user records with radio buttons...and he can delete record one by one using the radio button in front of the record and clicking delete button..the radio button has the value of primary key of record to be deleted..i post that value to another form and perform query operation to delete the specified record..but itz not working..
it shows error message:incorrect sql syntax..i think the problem is with radio button's value..kindly help me out of this..

<?php
include("dbconnect.php"); //for connecting database
include("printing.php"); //for printing query results
echo"<form action=\"confirm_deletus.php\" method=\"post\">"; //posted to another form
echo"<input type=\"submit\" value=\"deleteuser\" name=\"del\">";
$query="select * from users";
$re=mysql_query($query) or die
(mysql_error());
printresults($re); //list the users
echo"</form>";
?>

//confirm_deletus.php

<?php
include("dbconnect.php");
$uid=$_POST["user_id"]; //user_id is the primary key got from the value of radio button
$query="delete from users where user_id=$uid";
$re=mysql_query($query) or
die(mysql_error());
?>

//printing.php

<?php
function printresults($res)
{
if($p=mysql_num_rows($res)==0)
echo"no records found";
else
{
echo "<table bgcolor=#fffffff border=1 width=80%>";
while($p=mysql_fetch_array($res, MYSQL_NUM))
{
echo"<tr>";
while(list($key,$value)=each($p))
{
echo"<td valign=top align=left> $value </td>";
}
echo"</tr>"; //the radio button 's value is set to the primary key
echo"<input type=radio //of record
name=\”user_id\” value=\””.$p[“user_id”].”\”";
}
echo"</table>";
}
}
?>

  • 3 Contributors
  • 3 Replies
  • 91 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by gopi kannan

Dani AI

Generated

Symptom summary and likely cause (references to earlier posts)
reported an SQL syntax error when deleting a selected user. The list prints correctly, so the most likely root cause is that the radio input does not supply the expected value to the POST handler (an empty or malformed value produces a bad WHERE clause). guessed a query-assignment issue; correctly noted that using mysql_query(... ) or die(...) still returns a valid result on success, so the selection value and HTML generation are the places to check next.

Concrete checks and a safe fix

  1. Inspect the rendered markup (view source or DevTools) and confirm each radio has a proper name and a nonempty value attribute and that the radios live inside the same <form> that is submitted.
  2. Make the row loop produce associative arrays and escape values for HTML. Example pattern:
while ($row = mysql_fetch_assoc($result)) {
  echo '<tr>';
  echo '<td>' . htmlspecialchars($row['username']) . '</td>';
  echo '<td><input type="radio" name="selected_user" value="' . (int)$row['id'] . '"></td>';
  echo '</tr>';
}

Reference: mysql_fetch_assoc documentation and htmlspecialchars documentation.

Prefer parameterized delete and validate input
Avoid building SQL with raw POST data. Use parameterized statements (mysqli or PDO) or at minimum cast the incoming ID to an integer. Example (mysqli prepared statement):

$stmt = $mysqli->prepare('DELETE FROM users WHERE id = ?');
$stmt->bind_param('i', $selectedId);
$stmt->execute();

See mysqli prepared statements quickstart.

Quick troubleshooting checklist

  • Dump posted data (e.g., print_r($_POST)) to confirm the key is present.
  • Make sure the submit button and radios are inside the same form.
  • Avoid curly/typographic quotes in generated HTML.
  • If the printing function builds markup, return a string rather than echoing directly (as suggested) so the form structure can be controlled.
    Following these checks will reveal whether the issue is empty POST data, malformed HTML, or an unsafe SQL construction.

Recommended Answers

All 3 Replies

Member Avatar for squid44th

After a quick glance, I see that the value you're passing for $re is "mysql_query($query) or die
(mysql_error());".

If memory serves me, that would not be a correct variable for mysql_num_rows.

You could always put the db select with the die statement in the dbconnect.php. That way, the value for $re would be "mysql_query($query);" which would be correct for mysql_num_rows.

Member Avatar for nav33n

If memory serves me, that would not be a correct variable for mysql_num_rows.

Nope. $result=mysql_query($query) or die(mysql_error()); will assign the resultset to $result if the query executes without any error. If it encounters any error, the script print the die statement and exit.
When you call the function, instead of echoing everything inside the function, assign it to a variable and return that variable. for example,

function print($res){
 $output.="<table>";
$output.="<tr><td>Radiobutton</td></tr>";
......
return $output;
}

Then you can print it in the form. Also, test if the function is serving its purpose. Have a print statement to check the flow of the function.
}

Member Avatar for gopi kannan

no ya...iam getting the racords printed correctly...but the problem is in deleting them...if i select a record by clisking the radio button near it..the radio button's value property should have the value of primary key of that particular record..so that i may pass the value of radio button to another form and use it for my query to delete that particular record...error occurs in the line $query=delete from users where user_id=$uid;...uid is the radio button's value that i get through post..

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.