delete from sql with a delete.php file - php

Question

i am wanting to build a delete page to use to delete some data from my database.
when i put the id in it works fine but i am wanting it to pull the id from the url
www.example.com/delete.php?id=1234
<?php
$dbhost = 'localhost';
$dbuser = 'root';
$dbpass = '';
$conn = mysql_connect($dbhost, $dbuser, $dbpass);
if(! $conn )
{
die('Could not connect: ' . mysql_error());
}
$sql = 'DELETE FROM MYTABLE
WHERE created=<?php echo $_GET["id"]; ?>';
mysql_select_db('ely');
$retval = mysql_query( $sql, $conn );
if(! $retval )
{
die('Could not delete data: ' . mysql_error());
}
echo "Deleted data successfully\n";
mysql_close($conn);
?>
the part im having issues with is this part
WHERE created=<?php echo $_GET["id"]; ?>';
the error i am getting is "Could not delete data: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '=' at line 2"

Answer 1

<?php
$dbhost = 'localhost';
$dbuser = 'root';
$dbpass = '';
$conn = mysql_connect($dbhost, $dbuser, $dbpass);
if(! $conn )
{
die('Could not connect: ' . mysql_error());
}
$id = mysql_real_escape_string($_GET['id']);
$sql = "DELETE FROM MYTABLE
WHERE created='$id'";
mysql_select_db('ely');
$retval = mysql_query( $sql, $conn );
if(! $retval )
{
die('Could not delete data: ' . mysql_error());
}
echo "Deleted data successfully\n";
mysql_close($conn);
?>

Answer 2

learn quoting!
$sql = 'DELETE FROM MYTABLE
WHERE created=<?php echo $_GET["id"]; ?>';
$sql = 'Delete from MYTABLE WHERE created="'.$_GET['id'].'"';
Next thing is, google for sql-injections, and keep in mind that you should proof if $_GET['id'] is set in time

Answer 3

To concatenate a variable into a string, use the concatenation operator.
But your code is bad for severalreasons.
1: Sanitise your inputs
2: Don't use GET for anything that can change the state of the server, use POST instead.
Here's a story explaining one reason why

Answer 4

try this:
$id = $_GET['id'];
$sql = 'DELETE FROM MYTABLE
WHERE created=' .$id;
"." is used to concatenate the value of the variable $id
As for connecting to a db i suggest you to look up for PDO.

Answer 5

$sql="DELETE FROM MYTABLE WHERE created='".$_GET['id']."'";