Executing An SQL Query In A Link

vernie_29

I've been trying to figure out how to delete a record from one of my tables just by clicking a normal anchor tag like in the phpMyAdmin. So I took a look at the source code of one of the pages and I saw this.

Now can anybody help me understand it.
I know the onclick part brings up the confirm box.
Some of the stuff in the link actually makes sense to me.
But what is sql.php3?? Is it a file that I would have to modify to make it work on my page.
What does "goto=tbl_properties_structure.php3&back=tbl_properties_structure.php3&" do??
What does the "&amp" stand for is it a space??
Is "%60" stand for a single quote??
Do I need the style and class property to work??
If anybody can help me, any response would be greatly appreciated.

TheDefender

OK, let's break down the URL:

sql.php3 is the php page being called to execute the emptying of the table.

? is the designator notifying the PHP parser to start looking for variables...

The variables are broken down like this:
$GET['lang'] = "en-iso-8859-1"
$GET['server'] = "1"
$GET['db'] = "logs"
$GET['table'] = "calls"
$GET['goto'] = "tbl_properties_structure.php3"
$GET['back'] = "tbl_properties_structure.php3"
$GET['sql_query'] = "DELETE FROM calls" (Note, it is a back tick, not a single quote)
$GET['zero_rows'] = "Table calls has been emptied"

Basically, you'd have to ask the author how they are using the variables. Off-hand, I would say they are simply defining the structure they are going to use to delete all of the values in the calls table. (That's the obvious variable), the goto and back are probably used to define links, the zero_rows is probably used to report the emptying of the table after it is confirmed to be emptied. lang, server, db and table are all pretty self explanatory.

You don't need the style or class CSS identifiers to run this code at all, and the onclick event calls a JavaScript Function (I am not sure what the function is, other than to say that it's probably not a predefined one, and is probably a user defined function.)

Also, I didn't see it in the link you provided, but "&amp;" is the ASCII code for an ampersand symbol ( & ).

TheDefender

Note one thing... The deletion is not being done by the link itself, but by the script on the sql.php3 page. The link is just used to pass the variables to the called page (sql.php3) that it needs to empty the table... Also note, this query empties the entire table, and doesn't delete individual records.

Lastly, remember, PHP is parsed at the server, and then output to the browser, so their code probably uses variables to define the variables used in the string being passed. What you see is what's output to the browser only after the PHP has parsed the script to begin with.

The original code may look something like: