Delete multiple rows from mysql with checkbox - php

Question

I've got a query that displays a table with information about a message, I also have a column that gives the option to select the messages that the user wants to delete with a checkbox, once they have ticked the messages they want to delete, they then click on a submit button which takes them to the process page where the SQL statement to delete each selected message is made; however, the statement doesn't seem to work, this is what I have so far:
THE MESSAGE DISPLAY PAGE:
if ($_SESSION['user_session'] == "$current_user")
{
{
echo "<table border='1'>
<tr>
<th>Message ID</th>
<th>Username</th>
<th>Subject</th>
<th>Message</th>
<th>Delete?</th>
</tr>";
while($row = mysql_fetch_array($result))
{
echo "<tr>";
echo "<td>" . $row['message_id'] . "</td>";
echo "<td>" . $row['username'] . "</td>";
echo "<td>" . $row['sub'] . "</td>";
echo "<td>" . $row['message'] . "</td>";
echo "<td><input type='checkbox' name='check_list[]' value='" . $row['message_id'] . "' /></td>";
echo "</tr>";
}
echo "</table>";
}
}
THE PROCESS PAGE WITH SQL STATEMENT:
if(!empty($_POST['check_list']))
{
foreach($_POST['check_list'] as $check)
{
//connection to the database
$dbhandle = mysql_connect("XXX", "XXX", "XXX")
or die("Unable to connect to MySQL");
//select a database to work with
$selected = mysql_select_db("XXX",$dbhandle)
or die("Could not select examples");
//execute the SQL query to update the "returned" field to 1 wherever the loan_id is checked.
$result = mysql_query("DELETE FROM message WHERE message_id='$check'");
}
if ($result)
{
echo 'Messages Deleted';
}
}

Answer 1

if(!empty($_POST['check_list']))
{
$dbhandle = mysql_connect("XXX", "XXX", "XXX") or die("Unable to connect to MySQL");
$selected = mysql_select_db("XXX",$dbhandle) or die("Could not select examples");
$result = mysql_query("DELETE FROM message WHERE message_id IN (" . implode(',', $_POST['check_list']) . ")", $dbhandle);
if ($result !== false)
echo 'Messages deleted.';
}
You obviously should implement some more testing of the contents of $_POST['check_list'] before executing the query. We don't want evil people to do silly stuff.

Answer 2

As far as I can see there's nothing wrong with your code, you should really try a var_dump($check) before the SQL query to output what it contains, and a var_dump($_POST['check_list']) at the very beggining of the second page.
Also, I suggest you to take out the database connection of the foreach as you are doing multiple innecesary connections, like this:
if(!empty($_POST['check_list'])) {
// Output the variable $_POST['check_list']
var_dump($_POST['check_list']);
//connection to the database
$dbhandle = mysql_connect("XXX", "XXX", "XXX") or die("Unable to connect to MySQL");
//select a database to work with
$selected = mysql_select_db("XXX",$dbhandle) or die("Could not select examples");
foreach($_POST['check_list'] as $check) {
// Output the $check variable to see what it contains
var_dump($check);
//execute the SQL query to update the "returned" field to 1 wherever the loan_id is checked.
$result = mysql_query("DELETE FROM message WHERE message_id='$check'");
// For each $check, verify what message_id got deleted
if ($result) {
echo 'Message ID Deleted: ' . $check;
}
}
}