Deleting student data in msqli with php - php

Question

I have just migrated my page from mysql to msqli. Now, deleting data is confusing. Here is my code in Admin_Delete.php
require 'Connect.php';
$id = intval($_GET['id']);
$query = "DELETE * FROM student_information WHERE student_id='$_GET[id]'";
// not using return value, and add some debug info
mysqli_query($query) or die(mysql_error().PHP_EOL.$query);
// let's see if anything actually happened...
$rowsDeleted = mysqli_affected_rows();
if($rowsDeleted == 0) {
error_log("Nothing deleted for this query:".PHP_EOL.$query);
}
echo "<script language='javascript' type='text/javascript'>alert('$rowsDeleted row(s) deleted!')</script>";
echo "<script language='javascript' type='text/javascript'>window.open('Admin_Home.php','_self')</script>";
?>
This is my configuration to fix these.
Connect.php
<?php
$host = "localhost";
$dbusername = "root";
$dbpassword = "123456";
$dbname = "student";
$link_id = mysqli_connect($host,$dbusername,$dbpassword,$dbname) or die("Error " . mysqli_error($link_id));
?>

Answer 1

A couple of problems.
The reference to mysql_error should be mysqli_error($link_id).
The reference to mysqli_query should be mysqli_query($link_id, $query).
The reference to mysqli_affected_rows should be mysqli_affected_rows($link_id)
Also, you've used intval, to get an integer value from $_GET, but you're using reference to $_GET in the SQL text. If you aren't going to use a prepared statement, then you should be using mysqli_real_escape_string function to make potentially "unsafe" values "safe" for inclusion in SQL text.
$sql = " ... WHERE id='" . mysqli_real_escape_string($link_id, $id) . "'";
Syntax for DELETE statement is not correct. Either omit the *
DELETE FROM student_information WHERE ...
Or qualify the * with a table reference, or table alias
DELETE s.* FROM student_information s WHERE ...