PHP & MySQL - query confusion [closed] - php

Question

Closed. This question needs debugging details. It is not currently accepting answers.
Edit the question to include desired behavior, a specific problem or error, and the shortest code necessary to reproduce the problem. This will help others answer the question.
Closed 5 years ago.
Improve this question
I am trying to create a table row with PHP for each value in my MySQL database.
The siteName and siteId are being pulled correctly, and displaying fine how they are.
However, when I try to use a similar type of logic with the query in the if statement, it does not work as well. Currently, it deletes all rows from the folders table in my database, instead of just the one I have clicked on.
Hope that makes sense.
$results = mysqli_query($conn, "SELECT * FROM folders WHERE hidden = 0 ORDER BY siteName asc");
while ($row = mysqli_fetch_assoc($results)) {
<tr>
<td>
<span>
<?php echo($row["siteName"] . ' (' . $row["siteId"] . ')') ?>
</span>
<form method="POST">
<button name="deleteFolder">CLICK</button>
</form>
<?php
$conn = mysqli_connect($server, $username, $password, $database);
if (isset($_POST['deleteFolder']))
{
// deletes everything?
$testing = mysqli_query($conn, "DELETE FROM folders WHERE siteId = '".$row['siteId']."'");
}
?>
</td>
</tr>
<?php } ?>

Answer 1

This code is deleting everything currently because you're executing the delete query inside the loop that's displaying all the folders, using the id of each folder and deleting them as soon as it fetches them.
Pass the site id to delete as the button value, and delete before displaying the table if that value is set.
<?php
$conn = mysqli_connect($server, $username, $password, $database);
// delete first if the button was clicked
if (isset($_POST['deleteFolder']))
{
// use the value from $_POST here
$testing = mysqli_query($conn, "DELETE FROM folders WHERE siteId = '".$_POST['deleteFolder']."'");
}
$results = mysqli_query($conn, "SELECT * FROM folders WHERE hidden = 0 ORDER BY siteName asc");
while ($row = mysqli_fetch_assoc($results)): ?>
<tr>
<td>
<span>
<?php echo($row["siteName"] . ' (' . $row["siteId"] . ')') ?>
</span>
<form method="POST">
<!-- use the site id as the value of this button -->
<button type="submit" name="deleteFolder" value="<?= $row['siteId'] ?>">CLICK</button>
</form>
</td>
</tr>
<?php endwhile; ?>
Also, I didn't address it here but this query is vulnerable to SQL injection. Look into binding the site id value to a prepared statement instead of concatenating the value into your SQL.

Answer 2

First; I'm guessing that you already have a DB conn in order to execute the first query, so you don't need to create a new connection for each row.
Second; When you click the button, it should submit a POST request with the data to a php file that will execute the query (deletion) - like #Don't Panic has suggested. The way your logic is now, you are running the delete check inside the loop when the page loads.