Member Avatar for Olaoluwa_1

I have a Table that displays titled and first name columns and delete link on the 3rd column.

Unfortunately for a reason i don't understand, records are not deleting when the Delete link is clicked.

Please friends, help me figure out what's wrong here.

Table
<?php 

  $user_id = $_SESSION["user_id"]; //brought here via 
                                    session
   //select statement here
  // output data of each row
  while($row = $result->fetch_assoc()) {

    echo '<tr> <td scope="row">' . $row["titled"]. '</td> <td> '.$row["firstname"] .'</td> <td><a href="user_delete.php? 
                  delete=$row[user_id]">Delete</a> </td> </tr>';
   }

   } else {
   echo "0 results";
   }

   ?>    

user_delete.php code

  <?php
session_start();
require_once $_SERVER['DOCUMENT_ROOT'] . '/soap/includes/server.php';

if(isset($_GET["delete"]) )
{
    $user_id = $_GET["delete"];
    $sql= "DELETE FROM users WHERE user_id='$user_id'";
    $res= mysqli_query($con, $sql) or 
    die("Failed".mysqli_error($con));
    echo "<meta http-equiv='refresh' 
    content='0;url=user_settings.php'>";
}
?>
  • 3 Contributors
  • 2 Replies
  • 468 Views
  • 21 Hours Discussion Span
  • Latest Post Latest Post by alan.davies

Dani AI

Generated

The most likely immediate problem is how the Delete link is being built: the anchor is inside a single-quoted string and the array key is not concatenated, so the browser sees a literal string like delete=$row[user_id] (and the displayed HTML may also contain the newline/space). That means user_delete.php never receives a numeric id. As suggested, inspect the generated HTML (View Source / DevTools) and dump the sent value (print/var_dump or error_log) to confirm what actually arrives in $_GET/$_POST. As noted, switching destructive actions to POST and using parameterized queries is strongly recommended.

A safe quick fix for the link-generation (build the URL explicitly and escape output):

echo '<tr><td scope="row">' . htmlspecialchars($row['titled']) . '</td>'
   . '<td>' . htmlspecialchars($row['firstname']) . '</td>'
   . '<td><a href="user_delete.php?delete=' . urlencode($row['user_id']) . '">Delete</a></td></tr>';

Better approach: use a POST form + confirmation and handle deletion with a prepared statement. Example form (placed inside the row):

<form method="post" action="user_delete.php" onsubmit="return confirm('Delete this user?');">
  <input type="hidden" name="delete" value="<?php echo htmlspecialchars($row['user_id']); ?>">
  <button type="submit">Delete</button>
</form>

And example server-side (user_delete.php) pattern to use instead of inline SQL string concatenation:

if (!empty($_POST['delete'])) {
  $delete_id = (int) $_POST['delete'];
  $stmt = $con->prepare('DELETE FROM users WHERE user_id = ?');
  $stmt->bind_param('i', $delete_id);
  $stmt->execute();
  $stmt->close();
  header('Location: user_settings.php');
  exit;
}

Checklist and cautions: confirm $con is defined after the include, avoid meta-refresh redirects (use header+exit), escape output with htmlspecialchars, cast or validate IDs, add CSRF protection and permission checks, and prefer prepared statements to prevent SQL injection. If deletion still fails, view the produced href value, log $_GET/$_POST, and check the DB error log for the executed query and any MySQL errors.

Recommended Answers

All 2 Replies

Member Avatar for alan.davies

GET is never a good idea for operations that alter data in a db. You'd be better to use POST. Obviously this would entail buttons and multiple forms for normal forms, but you could leverage Ajax to send ID data via POST. This has the advantage of no page redirect. There are a few ways to do this though. Also you are open to sql injection as you don't sanitize your input data nor do you use prepared statements.

Edited by alan.davies
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.