[RESOLVED] Deleting a database record using a button with the value from a text box

shure2

If I change the 'compname's to 'compid' it works but its not that use friendly to delete a record using a number instead of a name

company_form.php

<form action="company_delete.php" method="get">
                    <div id="centre">
                        <p>Name:<br /><input name="compname" type="text"></p>
                        <input name="Delete" type="submit" value="Delete">
                    </div>
                </form>

company_delete.php

<?php
	require "connect.php";
	$compname = $_GET['compname'];
	$query =  "delete from company where compname = $compname";
	$result = @mysql_query($query, $connection)
or die ("Unable to perform query<br>$query".mysql_error());
	header("Location: company_page.php");
	exit();
?>

I can't get my head around why this works with compid but not compname, it would be great if someone could help me out and explain why this happens

servicebids

I'm assuming that the compname is a string and compid is a number. You have to put quotes around strings.

$query =  "delete from company where compname = '$compname'";

shure2

servicebids;10946364 wrote:
I'm assuming that the compname is a string and compid is a number. You have to put quotes around strings.
$query =  "delete from company where compname = '$compname'";

what a rookie mistake! (I know im a rookie, but this is just silly)

thanks so much!

bradgrafelman

Also note that your code is vulnerable to SQL injection attacks (and/or just plain SQL errors). User-supplied data should never be placed directly into a SQL query. Instead, it must first be sanitized with a function such as [man]mysql_real_escape_string/man.

Don't forget to mark this thread resolved (if it is) using the link on the Thread Tools menu.