[RESOLVED] How to add confirmation to my delete page

[cretam]

Hi,
I want to add message to ask "Are you sure you want to delete this record? Yes or No" When they click on yes it removes the record from the database and a confirmation message "Your record has been deleted. "

This is the code without the confirmations I have so far:

<?php

include("../Connections/conn.php");

// Delete all publications belonging to the author
// along with the entry for the author.
$id = $_GET['id'];
$ok1 = @mysql_query("DELETE FROM pub WHERE authorid='$id'");
$ok2 = @mysql_query("DELETE FROM author WHERE id='$id'");
if ($ok1 and $ok2) {
  echo '<h3>Author deleted successfully!</h3>';
} else {
  echo '<p>Error deleting author from database!<br />'.
      'Error: ' . mysql_error() . '</p>';
}

?>

Any help would be appreciated.

[konrad]

<?php

include("../Connections/conn.php");

// Delete all publications belonging to the author
// along with the entry for the author.
$id = $_GET['id'];
if( $id ){
if( $_POST['del_confirm'] == 'Yes' ){
$ok1 = @mysql_query("DELETE FROM pub WHERE authorid='$id'");
$ok2 = @mysql_query("DELETE FROM author WHERE id='$id'");
if ($ok1 and $ok2) {
   echo '<h3>Author deleted successfully!</h3>';
} else {
   echo '<p>Error deleting author from database!<br />'.
       'Error: ' . mysql_error() . '</p>';
}
}
elseif( $_POST['reject'] == 'No' ){
// user doesn't want to delete record
// perform some other action
}
else{
echo '
<form action="' . $_SERVER['PHP_SELF'] . '" method="post">
Are you sure you want to delete this record?<br />
<input type="submit" name="del_confirm" value="Yes" /> &nbsp;
<input type="submit" name="reject" value="No" />
</form>';
}
}
?> 

You should ensure, that the user is authorised to delete record. Otherwise anyone can delete authors simply by typying their id's in URL.

[cretam]

Thanks Konrad, got me well on my way. Changed the code abit and I thought it was all working but it doesn't appear to be removing the record from the database.
This is what I have now:

<?php

include("../Connections/conn.php");

// Delete all publications belonging to the author
// along with the entry for the author.
$id = $_GET['id'];
if( $id ){
echo '<form action="' . $_SERVER['PHP_SELF'] . '" method="post">
Are you sure you want to delete this record?<br />
<input type="submit" name="del_confirm" value="Yes" /> &nbsp;
<input type="submit" name="reject" value="No" />
</form>';
}
if( $_POST['del_confirm'] == 'Yes' ){
$ok1 = @mysql_query("DELETE FROM pub WHERE authorid='$id'");
$ok2 = @mysql_query("DELETE FROM author WHERE id='$id'");
if ($ok1 and $ok2) {
   echo '<h3>Author deleted successfully!</h3><br /><a href="authors.php">Manage Authors</a>';
} else {
   echo '<p>Error deleting author from database!<br />'.
       'Error: ' . mysql_error() . '</p>';
}
}
elseif( $_POST['reject'] == 'No' ){
	echo '<a href="authors.php">Manage Authors</a>'; 
}
?>

[konrad]

It doesn't delete record because there is no information about id in the form. $SERVER['PHP_SELF'] should be replaced with $SERVER['SCRIPT_NAME'] . '?' . $_SERVER['QUERY_STRING']:

<?php

include("../Connections/conn.php");

// Delete all publications belonging to the author
// along with the entry for the author.
$id = $_GET['id'];
if( $id && !isset($_POST['del_confirm']) && !isset($_POST['reject']) ){
echo '<form action="' . $_SERVER['SCRIPT_NAME'] . '?' . $_SERVER['QUERY_STRING'] .'" method="post">
Are you sure you want to delete this record?<br />
<input type="submit" name="del_confirm" value="Yes" /> &nbsp;
<input type="submit" name="reject" value="No" />
</form>';
}
if( $_POST['del_confirm'] == 'Yes' ){
$ok1 = @mysql_query("DELETE FROM pub WHERE authorid='$id'");
$ok2 = @mysql_query("DELETE FROM author WHERE id='$id'");
if ($ok1 and $ok2) {
   echo '<h3>Author deleted successfully!</h3><br /><a href="authors.php">Manage Authors</a>';
} else {
   echo '<p>Error deleting author from database!<br />'.
       'Error: ' . mysql_error() . '</p>';
}
}
elseif( $_POST['reject'] == 'No' ){
    echo '<a href="authors.php">Manage Authors</a>';
}
?>

[cretam]

Thanks Konrad, it's working fine now.

You're a champion!