Removing from the DB...

bugz

This is my first project with PHP and till this point I can't say I've done horribly bad. How would I go about passing a variable to a custom function through a link? I'll post my code so you can see what I mean. Also, if you see anything that's an amateur thing to do let me know, the only way I can better myself is with criticism.
The link inside the table should send the ID to the remove_from_DB(). When I tested it, it removed everything in the DB.

😕


<?php 
		//setting DB variables
		$host = "localhost";
		$user = "xxxxx";
		$pass = "xxxxx";
		$dbase = "test";


	$conn = mysql_connect($host,$user,$pass) or die("Could not connect");		
	$db = mysql_select_db($dbase);


	$query = mysql_query("SELECT * FROM phones");	

	echo "<table border='1' cellpadding='1' cellspacing='1'>";
	echo "<tr><td>ID</td><td>Name</td><td>Phone</td><td>Notes</td></tr>";

	while( $row = mysql_fetch_array($query)){
		echo "<tr><td>ID: " .$row['ID'].  "</td><td>" .$row['name']. "</td><td> " .$row['phone']. "</td><td>" .stripslashes($row['notes']). "</td><td><a href='" .remove_from_DB($row['ID']). "'>Remove?</a></td></tr>";

	}	

	echo "</table>";

?>



<?php
		function remove_from_DB(){
			echo $id;
			//setting DB variables
			$host = "localhost";
			$user = "xxxxx";
			$pass = "xxxxx";
			$dbase = "test";
			$sql = "DELETE FROM phones WHERE ID=$id";

		//connecting to & setting the DB
		$conn = mysql_connect($host,$user,$pass) or die("Could not connect");		
		$db = mysql_select_db($dbase);	

		//removing data
		mysql_query($sql);
		mysql_close($conn);
	}
?>

Krik

To pass a variable in a url your link would be like so

<a href="http://www.yoursite.com/yourpage.php?rowid=<?php echo $row['ID'];?>">Remove</a>

Doing the function call in the url will have php run that function before it outputs that link. Now if the function doesn't load with that page you just get an error message. But if it does load with that page it could mean the data gets deleted before you even see the option to delete it.

Now on the next page you need to use the get [man]superglobal[/man] to retrieve that variable

if (isset($_GET['rowid'])) {
    // do something with $_GET['rowid']
}

Next custom functions can not use any variable that is not passed to it. So in your function "$id" is not defined.

Now your call to the remove_from_DB() function does try to pass the variable but you don't reference it in the function.

function remove_from_DB($id){
    // function code here
}

That would allow the $id in the echo and the query to work

bugz

Krik;10959439 wrote:
To pass a variable in a url your link would be like so

Doing the function call in the url will have php run that function before it outputs that link. Now if the function doesn't load with that page you just get an error message. But if it does load with that page it could mean the data gets deleted before you even see the option to delete it.

What I wanted to do was build a link at the end of the line on a table, that when clicked it would call the remove_from_DB() with the correct ID of the link. Is there a better way to do this?

Apixen

Do a $_GET.

$_GET['id'];
$lol = mysql_query("SELECT * FROM [TABLE] WHERE  id='{$_GET['id']}'");

and so on.

If there is no id= in the url, it wont echo anything, therefore ,its perfect.

Crowly

Apixen;10959626 wrote:

$_GET['id'];
$lol = mysql_query("SELECT * FROM [TABLE] WHERE  id='{$_GET['id']}'");

This is not safe, always validate user input. In this case i suppose id is a number, then you should make sure that $_GET['id'] is a number before passing it to the query.
is_numeric,sprintf and type casting are functions and methods that will make it safer. Also use mysql_real_escape_string on all user input.

ex, everything might not be needed, but just to show "all in one" 😉

if (isset($_GET['id']) and is_numeric($_GET['id']))
  $id=(int)$_GET['id'];
else
  $id=0; // default value, or just skip the query and do a error message 

$sql=sprintf("SELECT * FROM [TABLE] WHERE  id=%d",mysql_real_escape_string($id));

$lol = mysql_query($sql);

Krik

bugz;10959624 wrote:
What I wanted to do was build a link at the end of the line on a table, that when clicked it would call the remove_from_DB() with the correct ID of the link. Is there a better way to do this?

I think you don't understand PHP. While HTML (and CSS and javascript) can be entirely processed by your web browser PHP is entirely handled by the website server. You can not run PHP function from the browser. A PHP function must be called by PHP and can not be directly ran by HTML (or javascript).

Now HTML (and javascript) can run PHP and even direct a specific function to run but it will always requires a new page to be loaded. And to get a specific function to run you either have to load a specific page or send a value via GET or POST.

Now there is a way to make it look like the link ran the function without loading a new page but that is by using AJAX, but it still sends a http request (same thing that happens when you load a new page) to a php script.