Delete and update statements not working with multiple checkboxes - php

Question

Brief:
Based on a query, I have multiple checkboxes generated dynamically. The value of each checkbox is a string from one of the query's rows;
upon form submission, another script is ran (del.php). This script gets the array of checkboxes that were checked and loops through them so it can ran another two queries, which is the delete and update queries.
They don't work! if I try the INSERT query, it works fine. But the DELETE AND UPDATE don't.
Here is my code:
index.php:
<?php
$gettips = mysql_query('SELECT body FROM tips WHERE body!="" and approved!="yes" and approved!="no"')or die(mysql_error());
$i=0;
while($tips = mysql_fetch_array($gettips))
{ ?>
<input type="checkbox" name="checkboxes[]" value="<?php print $tips[0] ?>" />
<input type="checkbox" name="checkboxesno[]" value="<?php print $tips[0] ?>" />
<a class="names"> - <span><?php print $tips[0] ?></span></a><br />
<? $i++;
}
?>
and del.php :
foreach($_POST['checkboxes'] as $check) {
mysql_query("INSERT INTO approved (body) VALUES ('$check') ");
mysql_query("UPDATE tips SET approved='yes' WHERE body='$check'");
}
foreach($_POST['checkboxesno'] as $key) {
mysql_query("DELETE FROM tips WHERE body='$key' ")or die(mysql_error());
}
mysql_error() doesn't throw any errors. Database connection works in both files. The values of the checkboxes are strings. I'm able to delete the record by adding the string itself rather than the POST $variable to the query.
(I have also noticed that I'm not able to delete older records, only the newly added ones).
UPDATE:
I realized that trying to delete records where row='string' wasn't the best practice, at least in my case. So, instead of passing strings as values to the checkboxes in the form, I decided to give the id value of the table.
here is the new code:
<?php
$gettips = mysql_query('SELECT id,body FROM tips WHERE body!="" and approved!="yes" and approved!="no"')or die(mysql_error());
$i=0;
while($tips = mysql_fetch_array($gettips))
{ ?>
<input type="checkbox" name="checkboxes[]" value="<?php print $tips[0] ?>" />
<input type="checkbox" name="checkboxesno[]" value="<?php print $tips[0] ?>" />
<a class="names"> - <span><?php print $tips[1] ?></span></a><br />
<? $i++;
}
?>
and the delete queries:
foreach($_POST['checkboxes'] as $check) {
// echo "INSERT INTO approved (body) VALUES ('$check') <br>";
// echo "UPDATE tips SET approved='yes' WHERE body='$check'<br>";
mysql_query("INSERT INTO approved (body) VALUES ('$check') ");
mysql_query("UPDATE tips SET approved='yes' WHERE body='$check'");
}
foreach($_POST['checkboxesno'] as $key) {
// echo "DELETE FROM tips WHERE id=$key <br>";
mysql_query("UPDATE tips SET approved='no' WHERE id=$key");
mysql_query("DELETE FROM tips WHERE id=$key ")or die(mysql_error());
}
I still don't know why the other way wasn't working, so if someone out there has a chance to explain, it would be awesome!

Answer 1

If you add some echo statements to your forloops and comment out the queries, you'll be able to see what exactly is being sent to mysql, and then you'll be better able to solve your problem.
foreach($_POST['checkboxes'] as $check) {
echo "INSERT INTO approved (body) VALUES ('$check') <br>";
echo "UPDATE tips SET approved='yes' WHERE body='$check'<br>";
//mysql_query("INSERT INTO approved (body) VALUES ('$check') ");
//mysql_query("UPDATE tips SET approved='yes' WHERE body='$check'");
}
foreach($_POST['checkboxesno'] as $key) {
echo "DELETE FROM tips WHERE body='$key' <br>";
//mysql_query("DELETE FROM tips WHERE body='$key' ")or die(mysql_error());
}

Answer 2

Try and protect yourself from SQL Injections: http://php.net/manual/en/security.database.sql-injection.php, can you please output the exact generated SQL query, it may be because of the SQL string not escaped.
Try escaping it with mysql_real_escape_string();