delete checked table rows with ajax - php

Question

I have checked through numerous questions to find the solution. I know I'm close, but I'm still not getting anything happening with my deleteData.php after confirming to delete.
Status:
Testing the array provides successful result.
Example: I checked rows 1, 2 & 31...then press #btn_del.
First, I get the confirm "Are you sure...?"
Next, I see the correct alert(array) 1,2,31
The next step...ajax is supposed to be sending this array data to deleteData.php for processing.
script
$('a#btn_del').click(function(e) {
e.preventDefault();
page = $(this).attr("href");
ids = new Array()
a = 0;
$(".chk:checked").each(function(){
ids[a] = $(this).val();
a++;
})
// alert(ids);
if (confirm("Are you sure you want to delete these courses?")) {
$.ajax({
url : 'deleteData.php',
data : ids,
type : "POST",
//dataType : 'json',
success : function(res) {
if ( res == 1 ) {
$(".chk:checked").each(function() {
$(this).parent().parent().remove();
}) // end if then remove table row
} // end success response function
} // end ajax
}) // end confirmed
}
return false;
}); // end button click function
}); // end doc ready
deleteData.php
<?php
require_once('config.php'); // Connect to the database
$dbc = mysqli_connect(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME)
or die ('Error connecting to MySQL server.'.$dbc);
foreach ($_POST['ids']
as $id) {
$sql = "DELETE FROM unit_genData
WHERE unit_id='" . $id . "'";
$result = mysqli_query($sql)
or die(mysqli_error($dbc));
} // end echo result count
mysqli_close($dbc); // close MySQL
echo json_encode(1);
?>
Edited:
Updated GET to POST.
Updated data: 'ids' to data: ids
Tested:
a) In php...echo $_POST['ids'];
NO RESULT
b) In js...commented out the if(confirm...
NO RESULT
Status:
Looks like the AJAX isn't firing (so to speak)

Answer 1

First of all, I would use POST instead of GET for a delete.
Then you need to send the correct data to your php script. What you have now is just a string, no key-value pairs which is what you expect at the backend.
The easiest way to send your data would be to use something like (assuming you have a form):
data: $('form').serialize(),
but you can also send an array like the one you are building:
data: ids,
The advantage of the first method is that values automatically get escaped / encoded (wouldn't make a difference with just integers obviously...).
At the backend you would need to prevent the sql injection problem you have now. You can do that using a prepared statement with bound parameters or in the case of numeric ID's you can cast them to integers.
Edit: As noted in the comments by #Fred-ii-, additional spaces in a string will cause your condition to fail. I would recommend a prepared statement but if you decide to cast to int and use that, just remove the quotes.
Also note that the procedural mysqli_* functions take the database link as the first parameter, that applies both to the query and to the error handling.