Why executing PHP mysql_query fails

Question

Why does this PHP code (mysql_query to delete a row where user name is $phpVar) do nothing?

mysql_query("DELETE FROM xraydeath WHERE user = $user");

And what is $user set to and what is the data in the table? — lc.
– lc., Commented Jul 30, 2012 at 6:42
Sidenote: Always remember that mysql_* functions are deprecated. Use their mysqli_* counterparts — pankar
– pankar, Commented Jul 30, 2012 at 6:48
this form of usage is prone to sql injection. use PDO and bind paramters. — Elzo Valugi
– Elzo Valugi, Commented Jul 30, 2012 at 6:49

complex857 · Accepted Answer · 2012-07-30 06:50:46Z

3

Probably because you forgot to quote the $user parameter also, please escape variables goes into sql query strings. If that parameter is connected directly to user input someone might submit ' or 1=1 -- and your whole table gone. This idea know as sql injection.

note: the old mysql_* functions are now deprecated, you should avoid using them, see the alternatives.

edited Jul 30, 2012 at 6:50

answered Jul 30, 2012 at 6:45

complex857

20.9k6 gold badges54 silver badges56 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Fluffeh · Accepted Answer · 2012-07-30 06:42:47Z

1

You need to put quotes around strings like this:

mysql_query("DELETE FROM xraydeath WHERE user = '$user'");

answered Jul 30, 2012 at 6:42

Fluffeh

33.6k16 gold badges69 silver badges80 bronze badges

Comments

juergen d · Accepted Answer · 2012-07-30 06:42:51Z

1

you forgot the quotes around the user:

mysql_query("DELETE FROM xraydeath WHERE user = '$user'");

answered Jul 30, 2012 at 6:42

juergen d

205k40 gold badges303 silver badges377 bronze badges

8 Comments

huysentruitw Over a year ago

and how do you see that the user column is a string type? :)

juergen d Over a year ago

I can't see it, but I feel it :)

Bhuvan Rikka Over a year ago

@WouterH If $user isn't a string,then the query should work fine,right!

pankar Over a year ago

@juergen d Your feelings might hurt you sometime ;)

huysentruitw Over a year ago

@BhuvanRikka: what about the mysql server that is down? a bad connection string? a missing table? a missing column? forgot to put it between <?php ?> tags? or no mysql_connect at all?

|

Elzo Valugi · Accepted Answer · 2012-07-30 06:45:33Z

0

What are you expecting? How it fails? Mysql_query is not suppose to do anything in the form that you are using it, except sending the query to the server.

 $result = mysql_query (...);
 // use the result if any.
 if (!$result) {
    die('Invalid query: ' . mysql_error());
 }
 // check the error that you might have

answered Jul 30, 2012 at 6:45

Elzo Valugi

28.1k17 gold badges97 silver badges115 bronze badges

Comments

Gntem · Accepted Answer · 2012-07-30 06:46:11Z

0

you need to put $user into quotes

mysql_query("DELETE FROM xraydeath WHERE user = '".$user."';");

also DELETE will succeed if even no rows where deleted, so to get how many rows where actually deleted use mysql_affected_rows()

$x = mysql_query("..");
echo "There were ".mysql_affected_rows()." rows affected";

**Try not to use mysql_* switch to PDO instead.

answered Jul 30, 2012 at 6:46

Gntem

7,2052 gold badges37 silver badges48 bronze badges

Comments

lc. · Accepted Answer · 2012-07-30 06:46:58Z

0

Assuming xraydeath.user is a character type, the value needs to be enclosed in quotes. If $user does not already contain the quotes, try:

mysql_query("DELETE FROM xraydeath WHERE user = '$user'");

And for kicks, try setting $user = "' OR '1'='1";! (Read up on SQL injection attacks and you should really switch to mysqli!)

It's also possible the table does not have a matching row, and therefore nothing will be deleted. Without knowing what you have assigned to $user and your data there is no way to know.

answered Jul 30, 2012 at 6:46

lc.

117k21 gold badges163 silver badges190 bronze badges

Comments

user1545296 · Accepted Answer · 2012-07-30 06:47:51Z

0

try this one:

mysql_query("DELETE FROM xraydeath WHERE user = '".$user."'");

or

mysql_query("DELETE FROM xraydeath WHERE user = '".$user."';");

every php variables that used in mysql, put them into '".$variable."'

answered Jul 30, 2012 at 6:47

user1545296

495 bronze badges

Comments

Genic · Accepted Answer · 2012-07-30 06:55:26Z

-1

First : mysql is deprecated. you should use mysqli. Second : What kind of type is user? if is int : (object oriented style)

mysqli::query("DELETE (what you want) FROM xraydeath WHERE `user` = '".$user."'");

if is varchar (string) :

mysqli::query("DELETE (what you want) FROM xraydeath WHERE `user` LIKE '".$user."'");

or (procedurel syle)

mysqli_query((your mysqli link), "DELETE (what you want) FROM xraydeath WHERE `user` LIKE/= '".$user."'");

Hope it helps

answered Jul 30, 2012 at 6:55

Genic

1932 silver badges16 bronze badges

5 Comments

huysentruitw Over a year ago

You are demonstrating the use of mysqli without prepared statements! IMHO this is a bad example of using mysqli, sorry.

Genic Over a year ago

the $user should be verified before executing the statement, mysqli_real_escape_string or something to prevent mysqliInjection.

huysentruitw Over a year ago

No you don't need mysqli_real_escape_string, you must use prepared statements and parameter binding. With prepared statements you never have to care about injections and escaping strings ever again. How cool is that? :)

Genic Over a year ago

Interesting. But still, he asked a solution for executing the query :D

huysentruitw Over a year ago

Everyone is trying to tell the OP to use mysqli, and you are giving a very bad example. Either remove the answer or adopt it and use a prepared statement and bind the $user parameter.

Collectives™ on Stack Overflow

Why executing PHP mysql_query fails

8 Answers 8

Comments

Comments

8 Comments

Comments

Comments

Comments

Comments

5 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

8 Answers 8

Comments

Comments

8 Comments

Comments

Comments

Comments

Comments

5 Comments

Your Answer

Sign up or log in

Post as a guest

Related