Help with delete link using product id

vistevaf

I'm building a site where the I can add and edit the products that are in mysql. I am trying to add a dynamic product id for each "delete" link. So instead of having a hard code of :

<a href ="delete.php?item=19">Delete</a>, it would be:

<a href="delete.php?item=$product_id>Delete</a>.

What is the code I need just to find the product id for each row and put it into the page. Here's my code so far:

<html>
<head></head>
<body>
<?php $global_dbh =mysql_connect("sql database","username","Password");

mysql_select_db("table name", $global_dbh);

$query_product ="select * from Product";
$result_id=mysql_query($query_product);
$column_count = mysql_num_fields($result_id);

echo("<TABLE BORDER=1>\n");

echo ("<TR ALIGN=LEFT VALIGN=TOP>");

echo ("<TD> Product Id</TD>\n");

echo ("<TD>Description</TD>\n");

echo ("<TD>Photo</TD>\n");

echo ("<TD>Product</TD>\n");

echo ("<TD></TD>\n");

echo ("<TD> Description</TD>\n");

echo ("</TR>");

while ($row = mysql_fetch_row($result_id))
{
echo ("<TR ALIGN=LEFT VALIGN=TOP>");

for ($column_num = 0;
$column_num < $column_count;
$column_num++)

 echo ("<TD> $row[$column_num]</TD>\n");
 echo ("<TD>edit</TD>\n");
 echo ("<TD><a href=delete.php?item=$id2>delete</a></TD>\n");
 echo ("</TR>\n");
 }
 echo("</TABLE>\n");

</body>

</html>

Thanks for all the help!

Thora_Fan

Well what is the name of your id in your table?

I would do this:

// FYI, I think you mean "host" instead of "sql database"
$global_dbh =mysql_connect("sql database","username","Password");

// FYI, I think you mean "database name" instead of "table name"
mysql_select_db("table name", $global_dbh);

$query_product ="select * from Product";
$result_id=mysql_query($query_product);

// create table header here
while($row = mysql_fetch_array($result_id, MYSQL_ASSOC))
{
     echo "<tr>\r";
     // put other cells here
     echo "<td><a href=\"delete.php?id=".$row["ID_COLUMN"]."\">Delete</a></td>\r";
     echo "</tr>\r";
}

// close table.

Where ID_COLUMN is your primary key in the table Product.

jnkwebdesignz

Here is a basic script I use

<?php
   // deleting script

   //Database Connection
   include $_SERVER['DOCUMENT_ROOT'] . '/database.inc.php';

   // get the id from the URL request
   $id = $_REQUEST['id'];

   // delete the row from the database
   $query = "DELETE FROM `images` WHERE `id`='$id'";

  $result = mysql_query( $query );

   // print out the results
   if( $result  )
   {
      echo( "Successfully deleted the entry." );
   }
   else
   {
      die( "Error: Could not delete entry: " . mysql_error() );
   }

?>

bradgrafelman

Except that your 'basic script' is wide open to SQL injection vulnerabilities/exploits.

jnkwebdesignz

bradgrafelman wrote:
Except that your 'basic script' is wide open to SQL injection vulnerabilities/exploits.

This script is open to SQL injections (e.g. someone using their browser and physically typing in an id number and running the script), but I do run this on the admin side so you need to be logged to a password protected directory to even be able to access the page.

I am still a novice php coder, so please feel free to let me know what else I might be missing.

vistevaf

Thank you for the help, it deletes and creates new products but it won't update. Any idea what I'm doing wrong?

Here is the update page, the form is where they would enter the new info:

<?php session_start();
$_SESSION[id]=$_GET['id'];
$global_dbh =mysql_connect();
mysql_select_db();
$query_product ="select * from Product where product_id=$_SESSION[id]";
$result=mysql_query($query_product);
$num=mysql_numrows($result); 
mysql_close();

$i=0;
while ($i < $num) {
$description=mysql_result($result,$i,"product_description");
$photo=mysql_result($result,$i,"product_photo");
$name=mysql_result($result,$i,"product_name");
$use=mysql_result($result,$i,"product_use");

?>

<form action="updated.php">
<input type="hidden" name="u_id" value="<? echo "$_SESSION[id]"; ?>">
Name: <input type="text" name="u_name" value="<? echo "$name"?>"><br>
Description: <input type="text" name="u_description" value="<? echo "$description"?>"><br>
Used for: <input type="text" name="u_use" value="<? echo "$use"?>"><br>
<input type="Submit" value="Update">
</form>

<?
++$i;
} 
?>

This is the updated page:

<? session_start();


$u_description=$_POST['u_description'];
$u_name=$_POST['u_name'];
$u_use=$_POST['u_use'];


$global_dbh =mysql_connect();
mysql_select_db();

$query="UPDATE Product SET product_description='$u_description]', product_name='$u_name', 
product_use='$u_use' WHERE product_id='$_SESSION[id]'";
mysql_query($query);
echo "Record Updated";

mysql_close();

?>
Click <a href><a href="index3.php">here</a> to go back home.

Thank you.