For some reason my sql query is not executing and the error message is not printing in php. Here is the code:
mysql_connect("$host", "$username", "$password")or die("cannot connect");
mysql_select_db("$db_name")or die("cannot select DB");
$sql = "DELETE FROM data WHERE id='".$_GET['id']."'";
echo $sql;
$result=mysql_db_query($sql);
if(!$result) {
$msg = "ERROR: ". mysql_error();
echo $msg;
}
I know its vulnerable for sql injection right now but im going to fix that after i get it working. Also, if i copy what $sql prints and paste it into phpmyadmin it works and it does go into the if statement.
foo.php?id=' OR 1=1-- I just deleted all records in yourdatatable. Please read up on SQL injection, then go learn PDO.