Delete script not working

Risingstar

Ever since I first got started with PHP, I've always had trouble with the delete from database script. I always said "As I get better, I'll figure it out". It's been almost a year and I've yet to figure it out. It seems simple enough but for some reason I can't get it to work!

Here's what I have:

<?php error_reporting(E_ALL);
$fTitle = $_GET['fTitle'];
$con = mysql_connect("localhost","USERNAME","PASSWORD");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }
mysql_select_db("spowpow1_files", $con);
mysql_error();
mysql_query("DELETE FROM files WHERE fTitle = $fTitle");
mysql_error();
mysql_close($con);
?>

I'm positive that all the information in there is correct (minus the username and password which I've changed for you guys :p).
I don't get any errors on the page or anything.

Here's the HTML form:

<form method = "GET" action = "delete.php">
   <b>File Title:</b><br>
      <input type = "text" name = "fTitle"><br /><br />
   <input type = "submit" value = "Submit">
</form>

Simple enough.

Any ideas on what's going wrong here?

Piranha

First thing is that you have a serious security issue in that code: You are vunrable for SQL injection. Basically what that means is that users can delete or change the whole database. I recommend that you read up on this in order to protect yourself from such things.

Then to deleting from the database. I think that you just miss the single quotes surrounding the variable. If you follow my example below it makes it easier to debug by just printing out the SQL string:

$sql = "DELETE FROM files WHERE fTitle = '$fTitle'"; 
echo $sql; // Use this row for debugging
mysql_query($sql);

Risingstar

Piranha wrote:
First thing is that you have a serious security issue in that code: You are vunrable for SQL injection. Basically what that means is that users can delete or change the whole database. I recommend that you read up on this in order to protect yourself from such things.

Then to deleting from the database. I think that you just miss the single quotes surrounding the variable. If you follow my example below it makes it easier to debug by just printing out the SQL string:
$sql = "DELETE FROM files WHERE fTitle = '$fTitle'"; 
echo $sql; // Use this row for debugging
mysql_query($sql);

Thanks so much for the security warning there. I'm reading up on it now.
Thanks also for the debugging tip there, that's extremely useful!

Thank-you!