Member Avatar for beginnerpals

I wanted to give my admin the power to search professors by name and provide them with a corresponding checkbox for each search result returned to help them select entries that he wants to delete (like we have in phpmyadmin for example). I'm posting the prof_name from a form that leads to this file. (Know there are sql injection holes, but i'll take care of them soon.) This is the php file where i'm showing my search results:

<?php
include('connectionfile.php');

session_start();
if (!isset($_SESSION["useradmin"])) { 
    header("Location: index.html");
}

else
{
$query = $_POST['prof_name']; 


    echo "<br><p>";

   $res = mysql_query("SELECT * FROM professor  WHERE (`prof_name` LIKE '%".$query."%') ") OR die(mysql_error()) ;

    $number= mysql_num_rows($res);
     echo "<br>No. of results returned: ";
     echo "$number";

 if($number > 0)
{

    echo ( "<br><br><form id='assign' action= 'delconfirm.php' method='post'> <table border='1' cellpadding='8' cellspacing= '6' bgcolor= '#302c21' bordercolor='#158bee' align='center' >" ) ; 

echo ("<br><tr><td><center><b>Professor ID</b></td><td><center><b>Professor Name</b></td><td><center><b>Professor Designation</b></td><td><center><b>Experience</b></td><td><center><b>Email ID</b></td><td><center><b>College Name</b></td><td><center><b>Subject Name</b></td><td><center><b>Select for Deleting</b></td></tr>");

            while($results = mysql_fetch_array($res))
    {           
                echo ("<tr><td><center>".$results['prof_id']."</td><td><center>".$results['prof_name']."</td><td><center>".$results['designation']."</td><td><center>".$results['experience']."</td><td><center>".$results['prof_email_id']."</td><td><center>".$results['college_name']."</td><td><center>".$results['subject_name']."</td> ");

    echo(" <td><center><input type= 'checkbox' name='selected[prof_id]' value= 'false' id='checkbox1' /> </td>"); 
    echo("</p></tr>");
                }

    echo("</table><br><br><br><center><input type= 'submit' name='delpro' value= 'Delete' /></form>"); 
}

        else
        { 
            echo "<br> No matches found.";
        }

mysql_close($id_link);

}    
?>

The page i'm leading to is delconfirm.php. I wanted that the entries selected in previous file be deleted and echo the entries that were deleted. But for that i'll have to make sure the prof_ids of the selected entries be passed in this file so i that can delete query on those ids. Don't know what code to write in this file :( can anyone assist me?

Everytime i have a problem solved, another just pops up :/ please help me. Thanks!

  • 5 Contributors
  • 9 Replies
  • 271 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by beginnerpals

Dani AI

Generated

Good catch by and — sending the prof_id values from each checkbox (an array) is the right idea. The remaining work is safe, server-side processing: validate the posted IDs, fetch the rows to confirm what will be deleted, and run a single, parameterized DELETE. Also follow a few basic safety and UX rules so deletions aren’t accidental or insecure.

Key steps to add after the checkbox form:

  • Require POST and confirm the checkbox array exists and is an array.
  • Cast/validate each item as an integer (do not trust posted strings).
  • Query the database for those IDs first (SELECT ... WHERE prof_id IN (...)) so the script can echo exactly what will be removed. Use html-escaping when printing names.
  • Run one prepared DELETE with placeholders (DELETE ... WHERE prof_id IN (...)) instead of looping single-row DELETEs. Wrap changes in a transaction if other related tables exist. Check affected rows and present a single success message (move any alerts outside loops — as noted).
  • Use POST/Redirect/GET after processing to avoid duplicate deletes on refresh. Log the operation and require proper admin session and a CSRF token.

Example (PDO) pattern to adapt:

<?php
// $pdo = new PDO(...); assume authenticated admin and CSRF checked
$selected = $_POST['selected'] ?? [];
$ids = array_values(array_filter(array_map('intval', $selected), function($v){ return $v>0; }));
if (!$ids) { header('Location: search.php?msg=none'); exit; }

$placeholders = implode(',', array_fill(0, count($ids), '?'));

$stmt = $pdo->prepare("SELECT prof_id, prof_name FROM professor WHERE prof_id IN ($placeholders)");
$stmt->execute($ids);
$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);

// show or log $rows here (use htmlspecialchars on output)

$pdo->beginTransaction();
$del = $pdo->prepare("DELETE FROM professor WHERE prof_id IN ($placeholders)");
$del->execute($ids);
$deleted = $del->rowCount();
$pdo->commit();

header('Location: search.php?deleted=' . (int)$deleted);
exit;
?>

Additional notes: migrate away from old mysql_* calls (use mysqli or PDO), prefer soft-deletes if accidental removals are a concern, and ensure the DB user has only needed privileges.

Recommended Answers

All 9 Replies

Member Avatar for TonyG_cyprus 
echo(" <td><center><input type= 'checkbox' name='selected[prof_id]' value= 'false' id='checkbox1' /> </td>");

this line seems to be sending an empty value
maybe...

echo(" <td><center><input type= 'checkbox' name='".$results['prof_id']."' value= '".$results['prof_id']."' id='checkbox1' /> </td>");

will send the name/value pair that you want to delconfirm.php

Edited by TonyG_cyprus
Member Avatar for masterjiraya


your revision of the code shall not be that way in name attribute.
it should be...

<input type=text name='selected[]' value ='checkbox1' id='checkbox1'>

and on php do some looping using foreach()

Member Avatar for TonyG_cyprus

With your code the name will become array, but the value will always be the same, could end up with multi values of 'checkbox1'......

Member Avatar for masterjiraya

your right as well @TonyG_Cyrpus. but the tricky part here is

while($results = mysql_fetch_array($res)){
echo ("<tr><td><center>".$results['prof_id']."</td><td><center>".$results['prof_name']."</td><td><center>".$results['designation']."</td><td><center>".$results['experience']."</td><td><center>".$results['prof_email_id']."</td><td><center>".$results['college_name']."</td><td><center>".$results['subject_name']."</td> ");
echo(" <td><center><input type= 'checkbox' name='selected[]' value= '".$results['prof_id']."' id='checkbox1' /> </td>"); 
echo("</p></tr>");
}

now value attribute is not set to default as false, then the value which is selected is inserted in array named as selected. and needs isset() function in php level

like this

if(isset($_POST['selected'])){

print_r($_POST['selected']);
// could also use implode(", ",$_POST['selected']);
}
Edited by masterjiraya
Member Avatar for beginnerpals

Okay, thanks for the suggestions. I'm going to put the code and test if it works the way i want it to as soon as my exam gets over... Will get back to you all in a day or two :)

Member Avatar for sandeepek

Hi,
It's working for me. But I had one problem like if I'm tryaing to delete multiple ckeckbox values
it will show alert box that number of time . So, please help me to solve this problem..,
Here is my code..,

.....checkbox.php......
<?php
include ("config.php");
//$query="SELECT * FROM documents";
//$result= mysqli_query($con, $query) or die("Invalid query");
//$count = mysqli_affected_rows($con); 
$select_user=mysql_query("select * from user_registration")or die(mysql_error());
?>
<html>
<head>
<body>
<table width="400" border="0" cellspacing="1" cellpadding="0">
<tr>
<td><form name="form1" method="post" action="delete.php">
<table width="800" border="0" cellpadding="3" cellspacing="2" bgcolor="#CCCCCC">
<tr>
<td colspan="5" bgcolor="#FFFFFF" align="center"><strong>Delete Multiple Files</strong></td>
</tr>
<tr>
<td align="center" bgcolor="#FFFFFF">#</td>
<td align="center" bgcolor="#FFFFFF"><strong>Id</strong></td>
<td align="center" bgcolor="#FFFFFF"><strong>User name</strong></td>
<td align="center" bgcolor="#FFFFFF"><strong>Email Address</strong></td>
<td align="center" bgcolor="#FFFFFF"><strong>Password</strong></td>
</tr>
<?php
while($row = mysql_fetch_array($select_user)){
?>
<tr>
<td align="center" bgcolor="#FFFFFF">
<input type="checkbox" name="checkbox[]" id="checkbox" value="<?php echo $row['id'];?>"></td>
<td bgcolor="#FFFFFF"><?php echo $row['id']; ?></td>
<td bgcolor="#FFFFFF"><?php echo $row['user_name']; ?></td>
<td bgcolor="#FFFFFF"><?php echo $row['email_address']; ?></td>
<td bgcolor="#FFFFFF"><?php echo $row['password']; ?></td>
</tr>
<?php
}
?>
<tr>
<td colspan="5" align="center" bgcolor="#FFFFFF">
<input name="delete" type="submit"   id="delete" value="Delete Files">
</td>
</tr>
</table>
</form>
</td>
</tr>
</table>
</body>
</head>
</html>

......delete.php......
<?php
include ("config.php");
$delete = $_POST['checkbox'];
echo $delete;
foreach($delete as $id)
   {
  // echo $id;
        $sql = "DELETE FROM user_registration WHERE id='".$id."'";
        $res = mysql_query($sql) or die(mysql_error());
        if($res)
            {
             echo '<script>alert("Data deleted successfully");</script>';  
            }
        else
         {
             echo '<script>alert("error");</script>'; 
         }
    }
?>
Member Avatar for delta_frost

That's because you have enclosed the <script> tags in the loop.So use it after the loop.If you want to show how many items were deleted,just use a variable to achieve it.

Member Avatar for sandeepek

Hi Deltafrost,

Thank you , Nice it's woriking fine.

Member Avatar for beginnerpals

Solved! Thank you masterjiraya and tonyg_cyprus. All i had to do was change one line:

<input type= 'checkbox' name='selected[]' value= ' ".$results['prof_id']." ' id='checkbox1' />

It sends the professor id of the selected entries and i can post them in the delete file :)

Edited by beginnerpals because: insert code
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.