Delete an image using link/id from database - php

Question

I want to delete an image by an button called 'DELETE'.
My image is saved on the server, my image link is saved into a database table.
To delete now works great, but every user can delete every users images right now by typing in the picture id in the URL.
uploads.php
<div id="myuploads">
<?php
//Configuration
$host = 'localhost';
$user = 'root';
$pass = '';
$db = 'myimg';
$salt = "u6d5u6mj65dehjum568nuu65umk57endjzu766imm57e8u5u56";
if(isset($_SESSION['username'])){
$hash = hash('sha224', $_SESSION['username']).$salt;
}
$conn = mysqli_connect("$host", "$user", "$pass", "$db");
//Script
if(isset($_SESSION['username'])){
$uid = $_SESSION['username'];
$dir = $uid . "/";
$alledateien = mysqli_query($conn, "SELECT * FROM imglinks WHERE uid='$uid'");
foreach ($alledateien as $datei)
{
echo "<div class='pictures'> \
<img class='pbild' src='" . $dir . $datei["link"] . "'><br/> \
<form action='functions/deleteimg.php'></div> \
<input class='deleteimg' type='submit' name='deleteimg' value='DELETE'> \
<input class='post' type='submit' value='PUBLISH'></form>";
}
}else{
header("Location: ../index.php");
}
?>
</div>
deleteimg.php
<?php
include '../config.php';
$uid = $_SESSION['username'];
$username = mysqli_query($conn, "SELECT uid FROM imglinks WHERE uid='$uid'");
foreach($username AS $name) {
if(isset($_GET['deleteimg']) && $uid = $name['uid']){
$sql = "SELECT * FROM imglinks WHERE id='".$_GET['deleteimg']."' LIMIT 1";
$filepath = mysqli_query($conn, $sql);
foreach($filepath AS $value) {
unlink($value['link']);
}
$uid = $_SESSION['username'];
mysqli_query($conn, "DELETE FROM imglinks WHERE id='".$_GET['deleteimg']."' AND uid='$uid'");
}}
The links given out coming out of the imglinks table of my database.
DATABASE STRUCTURE
If you need more detail, feel free to ask.

Answer 1

One thing that I would suggest / do when deleting I would use an anchor tag instead of a button to delete then on the anchor tag I will have action and id as query string. then on the deleteimg.php page I will query the action and the ID if the action is delete then delete the selected id.
Then you code will look like this :
uploads.php
<div id="myuploads">
<?php
//Configuration
$host = 'localhost';
$user = 'root';
$pass = '';
$db = 'myimg';
$salt = "u6d5u6mj65dehjum568nuu65umk57endjzu766imm57e8u5u56";
if(isset($_SESSION['username'])){
$hash = hash('sha224', $_SESSION['username']).$salt;
}
$conn = mysqli_connect("$host", "$user", "$pass", "$db");
//Script
if(isset($_SESSION['username'])){
$uid = $_SESSION['username'];
$dir = $uid . "/";
$alledateien = mysqli_query($conn, "SELECT * FROM imglinks WHERE uid='$uid'");
foreach ($alledateien as $datei)
{
echo "<div class='pictures'> \
<img class='pbild' src='" . $dir . $datei["link"] . "'><br/> \
<form action='functions/deleteimg.php'></div> \
<a class='deleteimg' href='functions/deleteimg.php?action=delete&id='".$datei['id']."'>DELETE</a><br>
<input class='post' type='submit' value='PUBLISH'></form>";
}
}else{
header("Location: ../index.php");
}
?>
</div>
Then deleteimg.php
<?php
// Your connection here...
// check if session is set here...
$action = $_GET['action'];
$img_id = intval($_GET['id']);
if($action === "delete"){
$sql = "DELETE FROM imglinks WHERE id='$img_id'";
if (mysqli_query($conn, $sql)) {
echo "Record deleted successfully";
//image delete... do something else
} else {
echo "Error deleting record: " . mysqli_error($conn);
}
}
mysqli_close($conn);
?>
This always works for me and always easy, hope you will find it useful.
NB: Read about mysqli prepared statements, against sql injections.. You can read here

Answer 2

You can:
Add a boolean field to your imglinks table named say 'show', and modify your query accordingly. In this case you'll be even able to 'undelete' accidentally deleted images.
If you're short on disk space then modify <input class='deleteimg' type='submit' name='deleteimg' value='DELETE'> to <input class='deleteimg' type='submit' name='deleteimg' value='".$image_to_delete."'> so that you'll see this link in your postdata and will be able to process it

Answer 3

It's not so complicated, just use like this :
*Root is your root directory !
$path = root/$uid/$imgname;
$query("DELETE FROM imagetable WHERE imgname = $imgname");
And to delete the image :
unlink($path);
And just use a form to submit imgname to your script !
*For more security, you can also add $uid to your query !

Answer 4

You need to change your buttons like this:
foreach ($alledateien as $datei)
{
echo "<div class='pictures'> \
<img class='pbild' src='" . $dir . $datei["link"] . "'><br/> \
</div><form action='functions/deleteimg.php'> \
<input type='hidden' name='img_id' value='".$datei["id"]."'> \
<input class='deleteimg' type='submit' name='deleteimg' value='DELETE'> \
<input class='post' type='submit' name='publish' value='PUBLISH'></form>";
}
Then on deleteimg.php, get the image id and execute a delete query:
if(isset($_POST['deleteimg']) && $_POST['deleteimg'] == 'DELETE'){
$img_id = $_POST['img_id'];
mysqli_query($conn, "DELETE FROM imglinks WHERE id='$img_id'");
}

Answer 5

Thanks for all answers, now i've completed it myself.
deleteimg.php
<?php
include '../config.php';
$uid = $_SESSION['username'];
if(isset($_GET['deleteimg'])){
$sql = "SELECT * FROM imglinks WHERE id='".$_GET['deleteimg']."' LIMIT 1";
$filepath = mysqli_query($conn, $sql);
$test = mysqli_fetch_array($filepath);
if($test['uid'] == $uid){
unlink($test['link']);
mysqli_query($conn, "DELETE FROM imglinks WHERE id='".$_GET['deleteimg']."' AND uid='$uid'");
echo 'File successfully deleted.';
header ("Refresh: 2; ../index.php");
} else {
echo 'You do not have the permission to delete this file.';
header ("Refresh: 2; ../index.php");
}
}