deleting a row in mysql and android - relational databases - php

Question

In android app the user can insert a player's name, his rating and post that data in my server. This is done by the following working code.
<?php
session_start();
require "init.php";
header('Content-type: application/json');
error_reporting(E_ALL);
ini_set("display_errors", 1);
$id_isSet = isset($_POST['player_id']);
$user_id_isSet = isset($_POST['User_Id']);
$best_player_isSet = isset($_POST['player']);
$rate_isSet = isset($_POST['rating']);
if($id_isSet && $user_id_isSet && $best_player_isSet && $rate_isSet){
$id = $_POST["player_id"];
$user_id = $_POST['User_Id'];
$best_player = $_POST['player'];
$rate = $_POST['rating'];
$sql_query = "INSERT INTO rating_players_table VALUES('$id','$best_player','$rate','$user_id');";
if(mysqli_query($con,$sql_query)){
$don = array('result' =>'success','message'=>'Προστέθηκε');
//$don = array('result' =>"success","message"=>"$id");
}
}else if(!$best_player_isSet){
$don = array('result' =>"fail","message"=>"Insert player name");
}else if(!$rate_isSet){
$don = array('result' =>"fail","message"=>"Rate player");
}
echo json_encode($don);
?>
Now I want the user to delete the players he rated. So for that I am doing the following.
<?php
include("init.php");
$delete_post = "delete from rating_players_table where
id='$_GET['player_id']'";
$run_delete = mysqli_query($con,$delete_post);
echo json_encode($don);
}
?>
Do you see what I am doing in the deleting code? I use the $_GET['player_id'] is order to delete the corresponding row. However, this code doesn't work. Any ideas on this problem? I am suspecting that the $_GET['player_id'] returns nothing, even if the rating_players_table has some rows of data.
Finally this is my android code.
public void deleteRatedPlayer() {
JsonObjectRequest jsonObjReq = new JsonObjectRequest(Request.Method.GET,
URL.DELETE_RATED_PLAYER,
new Response.Listener<JSONObject>() {
#Override
public void onResponse(JSONObject response) {
Log.d("TAG", response.toString());
try {
if (response.getString("result").equals("success")) {
Toast.makeText(getApplicationContext(), response.getString("message"), Toast.LENGTH_LONG).show();
} else if (response.getString("result").equals("fail")) {
Toast.makeText(getApplicationContext(), response.getString("message"), Toast.LENGTH_LONG).show();
}
} catch (JSONException e) {
e.printStackTrace();
}
}
}, new Response.ErrorListener() {
#Override
public void onErrorResponse(VolleyError error) {
}
});
// Adding request to request queue
AppController.getInstance().addToRequestQueue(jsonObjReq);
}
#Override
public boolean onKeyDown(int keyCode, KeyEvent event)
{
return (keyCode == KeyEvent.KEYCODE_BACK ? true :
super.onKeyDown(keyCode, event));
}
}

Answer 1

First of all, to fix your problem fix the deletion line:
// you cannot include $_GET['player_id'] directly in your string
// between the double quotes, you need to use concatenation in this case
$delete_post = "delete from rating_players_table where id='" . $_GET['player_id'] . "'";
Although this should solve the syntax problem, you still have another one: you don't check the input. I suggest you read about prepared statements in mysqli, about filter_input and SQL injection. Each one of the topics can be easily found with simple search.
// filter_input example usage
$player_id = filter_input(INPUT_GET, 'player_id', FILTER_SANITIZE_FULL_SPECIAL_CHARS);
$delete_post = "delete from rating_players_table where id='$player_id'";
Also, I suggest you add some kind of an authorization to limit users' ability to remove another users' entries. Currently, if a player sends a request, you delete the row directly, but what if the user sends you another one's id?