How can I delete the echo of an HTML table? - php

Question

I have the following code for the echo of an HTML table. In the table is a delete button. I want to delete the user's input from the database when the user hits the delete button. In the database there are more rows from the same user with different values and these are also shown with this code. How do I delete the specific input from one output (the one where the user hits delete)? I've been at it all day and tried a lot of things but can't find a way to do it. I'm just a beginner..
$sql = "SELECT publicaties.pub_Id,publicaties.userid,publicaties.titel,publicaties.type,publicaties.linkwerk,publicaties.linkuitgever,publicaties.beschikbaar,publicaties.hierbewerkt, users.username,users.userid FROM publicaties, users WHERE publicaties.userid=users.userid AND publicaties.userid='$user' ORDER BY pub_Id DESC LIMIT $offset, $rec_limit";
$retval = mysql_query( $sql, $conn );
if(! $retval )
{
die('Could not get data: ' . mysql_error());
}
if ($row["hierbwerkt"] ==1)
echo $row["hierbewerkt"];
else
{
echo" ";
while($row = mysql_fetch_array($retval, MYSQL_ASSOC))
{
echo "
<table width='415' border='0' class='tablepublicaties'>
<tr>
<td rowspan='2' bgcolor='#1E1E1E'> </td>
<td rowspan='2' bgcolor='#1E1E1E'><span class='user-imagelarge'><img src='Images/nopicture.png' alt='nopicture' width='273' height='381' class='user-imagelarge'></span></td>
<td valign='middle' nowrap bgcolor='#1E1E1E'><span class='linkkleur'>".$row["hierbewerkt"]."</td>
<td valign='middle' bgcolor='#1E1E1E'>".$row["username"]."</td>
</tr>
<tr>
<td valign='bottom' bgcolor='#1E1E1E'>Titel</td>
<td valign='middle' bgcolor='#1E1E1E'><span class='sterrenkleur'>".$row["titel"]."</span></td>
</tr>
<tr>
<td bgcolor='#1E1E1E'> </td>
<td nowrap bgcolor='#1e1e1e'> </td>
<td bgcolor='#1E1E1E'>Type</td>
<td bgcolor='#1E1E1E'>".$row["type"]."</td>
</tr>
<tr>
<td bgcolor='#1E1E1E'> </td>
<td bgcolor='#1E1E1E'> </td>
<td bgcolor='#1E1E1E'>Publicatie</td>
<td bgcolor='#1E1E1E'><a href='$row[linkwerk]'> ".$row["linkwerk"]."</a></td>
</tr>
<tr>
<td bgcolor='#1E1E1E'> </td>
<td bgcolor='#1E1E1E'> </td>
<td bgcolor='#1E1E1E'>Uitgever</td>
<td bgcolor='#1E1E1E'><a href='$row[linkuitgever]'> ".$row["linkuitgever"]."</a></td>
</tr>
<tr>
<td bgcolor='#1E1E1E'> </td>
<td nowrap bgcolor='#1E1E1E'> </td>
<td bgcolor='#1E1E1E'>Beschikbaar</td>
<td bgcolor='#1E1E1E'>".$row["beschikbaar"]."</td>
</tr>
<tr>
<td bgcolor='#1E1E1E'> </td>
<td bgcolor='#1E1E1E'><input type='image' class='backgroundgreyfotoos' src='Images/Icons/crossorangebutton.png' alt='Submit Form' width='15' height='15' border='0'/ ></td>
<td bgcolor='#1E1E1E'><img src='Images/lijntransparant.png' width='70' height='1' alt='lijn'></td>
<td bgcolor='#1E1E1E'><img src='Images/lijntransparant.png' width='224' height='1' alt='lijn'></td>
</tr>
</table>
<br>";
}
}
mysql_close($conn);

Answer 1

Your PHP-Script has to handle this deletion. For example you can define a GET-Parameter called action which defines what should be done:
$action = ( isset( $_GET['do'] ? $_GET['do'] : 'index' );
if( $action == 'index') {
// Print your Table
}elseif( $action == 'delete' ) {
// Send a SQL-Query to the database-server like 'DELETE FROM TABLE WHERE
// DELETE FROM publicaties WHERE publicaties.pub_Id = $pub_id [...]
}
For the deletion, you can link to yourscript.php?do=delete&pubId=123 so that the entry you've passed by pubId (accessable by $_GET['pubId']) gets deleted. The advanced version would be using ajax. Its more user-friendly and you can safe ressources because it's not necessary to reload the entire page. You keep on the table-page, make a ajax-request to yourscript.php?do=delete&pubId=123 in the background. When it was successfull, you can delete the table-row by manipulating the DOM. A library like jQuery would make those thinks much easier.
But as beginner it will be a good idea to skip the ajax-part initially and do it like the simple way I explained first. This is easier and you don't need any Javascript which is necessary for ajax.
As a second tip you should get information about SQL-Injections. Building dynamic SQL-Querys like
$query = 'DELETE FROM table WHERE id = ' . $_GET['id'];
is very insecure because every visitor can manipulate the Query by passing valid SQL as the parameter. HTTP-POST is not even better, it's only a bit more difficult because POST-Data is send in the HTTP-Body. You should at least filter input from outside by escaping it. Numeric values can also be casted like (int)$_GET['id']. But the best way is to use prepared statements because by manual escaping you may forget to escape correctly which can result in a security risk. By using prepared statements, you're not inserting variable data like from GET or POST directly in the query-string. Instead you're using placeholders, which gets replaced later. The replacing with these values is done by php automatically, so that you can't forget the escaping.

Answer 2

<?php
// is the page requested in the post method?
if($_SERVER['REQUEST_METHOD'] == 'POST')
{
// if we have received an x coordinate from the delete-button then it is pressed.
if(isset($_POST['delete_x']))
{
// make your delete query here
echo 'Now its time to delete record with id=' . $_POST['id'];
// if everything is working i recommand that you reload the page in the normal GET method.
// Then you need to uncomment the two following lines
//header('Location: ' . $_SERVER['SCRIPT_NAME']);
//exit;
}
// dump the $_POST array. Just for learning or debugging
echo '<pre>';
print_r($_POST);
echo '</pre>';
}
// dummy variabele, comes normal from your database
$row['id'] = 12;
?>
<form action="" method="post">
<input type="hidden" name="id" value="<?php echo $row['id']; ?>">
<input type="image" src="cross.png" name="delete">
</form>
The entire HTML form (last 4 lines) needs to be rendered for each row in the table!