Remove items in database based on status of checkbox - php

Question

I am trying to take input from an HTML form where there are checkboxes. The checkboxes are created with the student_ids from the database. Like so:
<td><input type="checkbox" name="{$row['STUDENT_ID']}" />
What I want to do is step through the Students table and check all of the entries against which of the checkboxes are checked. I want to then delete the entries from the database that have been checked with the checkboxes.
8 $query = "SELECT STUDENT_ID From Students";
9 $result = mysql_query($query) or die(mysql_error());
10 while($row=mysql_fetch_array($result)){
11 $checkname=$row['STUDENT_ID'];
12 foreach($_POST[$checkname] as $student_id =>val)
13 {
14 if($val == 'YES'
15 {
16 echo $_POST['STUDENT_ID'];
17 $query = "DELETE FROM Students WHERE STUDENT_ID" . mysql_real_escape_string($STUDENT_ID);
18 }
19 echo $query;
20 $result = mysql_query($query) or die(mysql_error());
21 //echo $POST['STUDENT_ID'];
22 }
23 }

Answer 1

Create an array of checkbox :
<input type="checkbox" name="studentID[]" value="{$row['STUDENT_ID']}" />
From PHP :
$studentID = $_POST['studentID'];
foreach($studentID as $ID){
echo $ID.'<br />'."\n";
}
EDIT :
Not sure but I think this is the right way :
$studentID = $_POST['studentID'];
$i=0;
foreach($studentID as $ID){
$i++;
echo $_POST['studentID'][$i].'<br />'."\n";
}

Answer 2

Try this for your form:
<input type="checkbox" name="STUDENT_ID[<?php echo $row['STUDENT_ID'] ?>]" value="YES" />
and this for your PHP loop:
foreach ($_POST['STUDENT_ID'] as $student_id => $val) {
if ($val == 'YES') {
$query = "DELETE FROM Students WHERE STUDENT_ID=" . mysql_real_escape_string($student_id);
$result = mysql_query($query) or die(mysql_error());
}
}

Answer 3

A better way of doing this is to take the Student IDs from your checkboxes that were submitted and then run deletes on those.
HTML
<input type="checkbox" name="students_to_delete[]" value="{$row['STUDENT_ID']}" />
PHP
$students_to_delete = $_POST['students_to_delete'];
if(is_array($students_to_delete) && count($students_to_delete) > 0) {
$query = "DELETE FROM Students WHERE STUDENT_ID IN (" . implode(",", $students_to_delete) . ")";
$result = mysql_query($query) or die(mysql_error());
}

Answer 4

The above code is vulnerable to SQL injection. If someone posts back to the server a value of 0 OR STUDENT_ID!=0 then all rows in the Students table will be deleted.
Your code is also inefficient - you are returning all the students and then iterating over each student to see if this requires deleting.
You would be better using in your markup:
<input type="checkbox" name="STUDENT_TO_DELETE" value="$row['STUDENT_ID']" />
and then in the php:
foreach ($_POST['STUDENT_TO_DELETE'] as $student_id => $val) {
$sql = "DELETE FROM Students WHERE STUDENT_ID=" . mysql_real_escape_string($student_id);
mysql_query($sql);
}
}