使用Angular和PHP删除数据

Question

I want to delete data with PHP and Angular form MySQL. this is my code :

Angular

    $scope.delete = function(){
    that = this;
    $http.get("delete.php").success(function(data){
        $scope.users.splice(that.$index, 1)
    })
}

PHP

$data = json_decode(file_get_contents("php://input"));
$subject = mysql_real_escape_string($data->subject);
mysql_select_db("angular") or die(mysql_error());

$tbl="Customers";
$subject = $_GET ['index'];
$sql="DELETE FROM $tbl WHERE subject = '$subject'";
$result = mysql_query($sql, $con);
if($result){
    echo "Deleted Successfully";

}else {
    echo "ERROR";
}  

DB

I have a table "Customers" with subject and body cell

JavaScript code worked correctly but after refreshing data still alive !!
where am I wrong ?

Answer 1

as mentioned in comments, your code is vulnerable to sql injection attacks

---

you need to add subject to your request

angular

$scope.delete = function(){
var subject = // get subject somehow ...
that = this;
$http.get("delete.php?subject=" + subject)
   .success(function(data){
       $scope.users.splice(that.$index, 1)
    })
}  

php

$tbl="Customers";
$subject = $_GET ['subject'];
$sql="DELETE FROM $tbl WHERE subject = '$subject'";
$result = mysql_query($sql, $con);
if($result){
    echo "Deleted Successfully";

}else {
    echo "ERROR";
}