[RESOLVED] Last time today, I promise! Delete question

dapuxter

<?php
$id=$_GET['id'];
$con = mysql_connect("server", "user", "password");
if (!con)
   {
   die('Could not connect: '. mysql_error());
   }
mysql_select_db("outage", $con);
$sql=mysql_query("DELETE FROM outage WHERE ID='$id'");
if (mysql_affected_rows($con) > 0) {
	echo "Outage deleted\n";
	}
	else {
	echo "Something's wrong:".mysql_error();
	}
mysql_close($con)
?>

This code returns "Something's wrong: " but no mysql error. What glaring, newbish php error have I committed this time? 😃

laserlight

Possibly nothing. There just may be no rows with the given ID.

dapuxter

I got it, there was a magic quotes problem. Thanks though, you put me on the right track. 🙂

Piranha

Why check if there are affected rows anyway? It may be that someone else have deleted the row already, and then you would recieve an error. Just check if mysql_errno > 0, then you will see if there is an error.

But your code is very vunrable to sql injection. What if I type ' or '' = '. Then the query would be DELETE FROM outage WHERE ID='' or '' = '' and everything in the table would be deleted.

dapuxter

Good question. I actually just copied the error checking part from the script I use to update the table. Seemed like the easiest way to make sure that there was a row affected by the operation at the time.

I plan on beefing up security ASAP, but for now I'm being rushed to get a functional version out and there's only going to be myself and two other people with access to it so I'll know who to look for if something goes wrong. If some malicious person is able to bypass all of our corporate security measures and get access to our intranet from outside, I don't think I'm able to write code to stop them from messing with my table if they want. 🙂

Piranha

Do you have the security at the login page? If not everyone in the intranet can access it (by using sql injection) and do what I showed.