deleting info from tables

[artist-ink]

I am using the following code to display and edit some information in a database.

<?
$MYSQLCONN = mysql_connect("host","user","pass") 
or die("<b>Error connecting to mySQL database.</b><br><br>Please try again later.");
mysql_select_db("DB",$MYSQLCONN) 
or die("<b>table  could not be reached. Please try again later.</b><br><br>Script execution terminating.");


    if(isset($ends_design_edit_go)) //Displays form to edit database info.
{
	$query = "SELECT `Link_ID`,`Link_Display`,`Link_Description`,`Link_URL`,`Category`
				FROM `Link_Info` WHERE `Link_ID` = '$uid' LIMIT 1"; //where does uid come from
	$result = mysql_query($query);									//why it is needed, why can Link_ID be used?	
	 while($row = mysql_fetch_array($result)) 
	 	{
			$ends_Link_ID = $row['Link_ID'];
			$ends_Link_Display = $row['Link_Display'];
			$ends_Link_Description = $row['Link_Description'];
			$ends_Link_URL = $row['Link_URL'];
			$ends_Category = $row['Category']; 


			$Link_ID = stripslashes($Link_ID);
			$Link_Display = stripslashes($Link_Display);
			$Link_Description = stripslashes($Link_Description);
			$Link_URL = stripslashes($Link_URL);
			$Category = stripslashes($Category);
?>

			<!-- need to link 'Category' values to values in table -- use drop down selection box
			possibly add option to delete this entry from table -->

			<form method="post" action="Update_Link_Info2.php" name="editForm">
			<table border="1" cellpadding="2" cellspacing="2">
			<tr><td>ID</td>
			<td><input type="hidden" name="Link_ID" value="<? echo $ends_Link_ID; ?>"></td></tr>
			<tr><td>Link_Display</td>
			<td><input type="text" name="Link_Display" value="<? echo $ends_Link_Display; ?>"></td></tr>
			<tr><td>Link_Description</td>
			<td><input type="text" name="Link_Description" value="<? echo $ends_Link_Description; ?>"></td></tr>
			<tr><td>Link_URL</td>
			<td><input type="text" name="Link_URL" value="<? echo $ends_Link_URL; ?>"></td></tr>
			<tr><td> Category</td>
			<td><input type="text" name="Category" value="<? echo $ends_Category; ?>"></td></tr>
			<tr><td>&nbsp;</td>
			<td><input type="hidden" name="ends_design_edit_save" value="TRUE"></td></tr>
			<tr><td colspan="2"><input type="submit" value="Save Changes"></td></tr></table>

			<!--//End edit form -->

<?


		}			

} 
else if(isset($ends_design_edit_save)) 
{					
 	$Link_ID = addslashes($Link_ID);
	$Link_Display = addslashes($Link_Display);
	$Link_Description = addslashes($Link_Description);
	$Link_URL = addslashes($Link_URL);
	$Category = addslashes($Category);

	$query = "UPDATE `Link_Info` SET `Link_ID` = '$Link_ID',`Link_Display` = '$Link_Display',
	`Link_Description` = '$Link_Description',`Link_URL` = '$Link_URL',`Category` = '$Category'
	WHERE `Link_ID` = '$Link_ID' LIMIT 1";

		if(!mysql_query($query)) 
		{ 
			echo "Database update failed."; 
		} 

		else 
		{ 
			echo "Database update was successful."; 
		}

	echo "<br><br><a href=Update_Link_Info2.php>Back to Data Entry</a>";
   } 
   else 
		{
		$query = "SELECT `Link_ID`,`Link_Display`,`Link_Description`,`Link_URL`,`Category`
		FROM `Link_Info` ORDER BY `Link_ID` ASC";

	if(!mysql_query($query)) 
	{ 
		echo "Could not select from database."; die(); 
	} 
	$result = mysql_query($query);
	echo "<p><b>Select Record to Edit</b></p><p><table>";
	while($row = mysql_fetch_array($result)) 
	{
     	$ends_Link_ID = $row['Link_ID'];

		$ends_Category = $row['Category'];
		echo "<tr><td>Category: $ends_Category</td></tr>";

		$ends_Link_Display = $row['Link_Display'];
		echo "<tr><td>Display Name: $ends_Link_Display</td></tr>";

		$ends_Link_Description = $row['Link_Description'];
		echo "<tr><td>Link Description: $ends_Link_Description</td></tr>";

		$ends_Link_URL = $row['Link_URL'];
		echo "<tr><td>Link URL: $ends_Link_URL</td></tr>";

		echo "<tr><td><a href='Update_Link_Info2.php?uid=$ends_Link_ID&ends_design_edit_go=1'> 
		<font color=#0000FF>EDIT</font></a></td></tr>"; //does 1=true?

		//possibly add 'DELETE' database entry here?
		//echo "<tr><td><a href='Update_Link_Info.php?uid=$ends_Link_ID&ends_design_edit_go=SOME VALUE'> 
		//<font color=#0000FF>DELETE this entry</font></a></td></tr>";

		echo "<tr><td>&nbsp;</td></tr>";

	}
	echo "</table>";

?>
<?
		} 

?>

I would like to change this a little and i'm not sure how. In addition to having the option to edit the information in the table, i'd like to be able to delete an entry. I'm assuming that the MySQL for this would be somethign like:
DELETE * FROM Link_Info WHERE WHERE Link_ID = '$Link_ID'

I don't know where to put this in exactly or how to do it.

[lazzerous]

Within the while loop, add a form submission for deletion.

<form method='post' name='delete_item_<? echo $ends_Link_ID; ?>' action='delete_entry.php'>
<input type='hidden' name='link_id' value='<? echo $ends_Link_ID; ?>'>
<input type='submit' name='del_entry_submit' value='Delete This entry'>
</form>

now create delete entry.php:

<?
if (isset($_POST['link_id']) && trim($_POST['link_id'] != "") && ereg("^[0-9]+$", $_POST['link_id'])){
    if (!mysql_query("DELETE FROM Link_Info WHERE Link_ID='" . $_POST['link_id'] . "'")){
    	echo "Entry Deletion Failed!";
    }else{
    	echo "Entry Deletion Succeeded";
    }
}
?>  

We're doing this as a form for security purposes. Instead of a form you could just create a link pointing to delete_entry.php?link_id=$link_id

BUT

any schmore could access that script, change the value of $link_id, and ruin your day.

We're also verifying that the entry is numeric with the use of regular expressions.

Hope this helps
-=Lazzerous=-