unlink() function not working

jtgmagic

Someone can tell me what I doing wrong ? my code is deleting a product from a database and I want to delete the image of that product
my code

if((isset($GET["remove"])) && ($GET["remove"] != "")){

$idproduct = $_GET["remove"];

$sql = "DELETE FROM products WHERE idproduct = '".$idproduct."'";
$query = mysqli_query($connect, $sql) or die ("Error");
	while($result = mysqli_fetch_assoc($query)){

		unlink($frontpage_url."/images/".$result['imagem']);

		echo "success";

}

}

this is the error that give me

WARNING: MYSQLI_FETCH_ASSOC() EXPECTS PARAMETER 1 TO BE MYSQLI_RESULT, BOOLEAN GIVEN IN /HOME/HOSTING/ALUNOS.ETIC.COM/PUBLIC_HTML/EA_A40489/PROJECTO/BACKOFFICE/PRODUTOS.PHP ON LINE 11

bradgrafelman

"DELETE" queries don't return any records. Sounds like you first need to SELECT the appropriate row in order to retrieve the information you need from it before you delete it.

EDIT: Also, forgot to point out... user-supplied data should never be placed directly into a SQL query, else your code will be vulnerable to SQL injection attacks and/or just plain SQL errors; see [man]security.database.sql-injection[/man] for more info.

jtgmagic

bradgrafelman;11039331 wrote:
"DELETE" queries don't return any records. Sounds like you first need to SELECT the appropriate row in order to retrieve the information you need from it before you delete it.

EDIT: Also, forgot to point out... user-supplied data should never be placed directly into a SQL query, else your code will be vulnerable to SQL injection attacks and/or just plain SQL errors; see [man]security.database.sql-injection[/man] for more info.

okay thanks for that I will try.
user-supplied should never be placed in SQL query? how should be ?

bradgrafelman

jtgmagic;11039361 wrote:
user-supplied should never be placed in SQL query?

Not directly, no; you must first sanitize it or use prepared statements. The PHP manual page I linked to explains this in greater detail.