deletion from mysql through php - php

Question

I am trying to delete a product listing from my shirt_types table (which is tee-shirt products). I have an administrator page that list all the items in the table along with there information. I have added a delete link at the end of the columns for each item. When I click the delete button it redirects me to the shirt_delete page like wanted, but then nothing. It includes the header, then the rest of the page is blank. I think at the very least, the header and the footer should be displayed but this is not the case. Below is the code I used is list_shirts:
$select_shirts = "SELECT shirt_type, shirt_quantity, shirt_color, price, shirt_description, photo, shirt_types_id from shirt_types order by $sort";
$exec_select_shirts = #mysqli_query($link, $select_shirts);
if(!$exec_select_shirts){
echo "The shirt types information could not be retrieved from the shirt_types table because of: ".mysqli_error($link);
mysqli_close($link);
include('footer_admin.php');
die();
} else {
echo "<div id='list_users'><table id='list_user' border='0'>";
echo "<tr>";
echo "<th><a href='".$_SERVER['PHP_SELF']."?sort=size&bool=".!$bool."'>Size</a></th>";
echo "<th><a href='".$_SERVER['PHP_SELF']."?sort=qnty&bool=".!$bool."'>Quantity</a></th>";
echo "<th><a href='".$_SERVER['PHP_SELF']."?sort=color&bool=".!$bool."'>Color</a></th>";
echo "<th><a href='".$_SERVER['PHP_SELF']."?sort=price&bool=".!$bool."'>Price</a></th>";
echo "<th><a href='".$_SERVER['PHP_SELF']."?sort=desc&bool=".!$bool."'>Description</a></th>";
echo "<th><a href='".$_SERVER['PHP_SELF']."?sort=photo&bool=".!$bool."'>Photo</a></th>";
echo "<th>Delete</th>";
echo "</tr>";
while ($one_row = mysqli_fetch_assoc($exec_select_shirts)) {
echo "<tr>";
echo "<td class='first'>".$one_row['shirt_type']."</td>";
echo "<td class='second'>".$one_row['shirt_quantity']."</td>";
echo "<td class='first'>".$one_row['shirt_color']."</td>";
echo "<td class='second'>".$one_row['price']."</td>";
echo "<td class='first'>".$one_row['shirt_description']."</td>";
echo "<td class='second'><img src='./images/".$one_row['photo']."' /></td>";
echo "<td class='first'><a href='shirt_delete.php?shirt_types_id=".$one_row['shirt_types_id']."'>Delete</a></td>";
echo "</tr>";
}
and here is the shirt_delete.php file that I am attempting to use to delete the shirts and their information from the database.
<?php
require('mysql_connect.php');
session_start();
if (isset($_SESSION['shirt_users_id']) && isset($_SESSION['full_name'])) {
$title="Delete Shirts Page";
include_once("header_admin.php");
if(!empty($_GET['shirt_types_id'])){
$shirt_types_id = $_GET['shirt_types_id'];
mysqli_query($link, "SET AUTOCOMMIT = 0");
$del_shirt_users_id = "DELETE shirt_types.*
FROM shirt_types
WHERE shirt_types_id = $shirt_types_id";
$$del_shirt_types_id = #mysqli_query($link, $del_shirt_types_id);
if(!$$del_shirt_types_id){
rollback(mysqli_error($link));
}else{
mysqli_query($link, "COMMIT");
header('refresh: 0; url=list_shirts.php');
}
}else{
echo "Problem occurred";
header('refresh: 3; url=list_shirts.php');
}
} else {
echo "You are not an authentic administrator. Being directed to the login page...";
header("Refresh: 2; url='login.php'");
}
mysqli_close($link);
require("footer.php");
die();
?>
NOTE: I understand that SQL injection is a real thing and in a real world application that this code would not suffice. But this is a part one course of a three part series. We are not to worry about sql injection at the present moment in time. Thank you everyone for your suggestions and worries about this though!

Answer 1

Try using, Remove shirt_types.*
$del_shirt_users_id = "DELETE FROM shirt_types
WHERE shirt_types_id = $shirt_types_id";
instead of
$del_shirt_users_id = "DELETE shirt_types.*
FROM shirt_types
WHERE shirt_types_id = $shirt_types_id";
and also, change :
$del_shirt_types_id = #mysqli_query($link, $del_shirt_types_id);
if(!$del_shirt_types_id){
instead of
$$del_shirt_types_id = #mysqli_query($link, $del_shirt_types_id);
if(!$$del_shirt_types_id){

Answer 2

By building SQL statements with outside variables, you are leaving yourself wide open to SQL injection attacks.
In your specific case, if someone shirt_types_id with a value of "0 or (1=1)", then the SQL that you will create will look roughly like this:
DELETE FROM shirt_types WHERE shirt_types_id = 0 or (1=1)
and since 1=1 is always true, then you will delete every shirt_types record.
Please learn about using parametrized queries, preferably with the PDO module, to protect your web app. http://bobby-tables.com/php has examples to get you started, and this question has many examples in detail.