单击时删除mysql行

Question

Here is the link style

<a href='del-user.php?id={$row['username']}'>Delete</a>

{$row['username']} will grab the username field from the Admin-CMS users table

Now..... Here is what it will take you to when you click it:

del-user.php?id=billy

---

NOW FOR WHAT I AM ATTEMPTING

I want to read the link and delete the row with a username of billy

Here is my del-user.php file

<?php
  if($_GET['id'] != ""){
    $userID = $_GET['id'];
    $sql = "DELETE FROM users WHERE username='".$userID."'";
    $query  = mysql_query($sql);
  }
?>

What am I doing wrong? Btw my database setup is

TABLE   is called :     users
COLUMN  is called :     username

Answer 1

First off, ESCAPE YOUR DATA. Or use prepared statements. Your code is vulnerable to SQL injection.

Second, don't use mysql libraries. They are depreciated. You need to use mysqli instead.

Third, where is your connection pointer? You need to have created one somewhere and pass it to your query function.

$con = mysqli_connect(...);
$result = mysqli_query($con, $sql);