Try this. First, there is no method "PO"
method="PO">
So it's just defaulting to the GET method for the form which is alright I guess. Be mindful if you fix it
method="post">
you'll now need to look for $_POST variables instead of $_GET.
The difference is: GET changes the address bar URL, POST does not; GET has a limited size of input, POST has a much larger size. In the context of this small task, either is OK.
Second, unquoted array keys may be interpreted as
constants so in effect it may be doing
delete from table where id=''
So start with
$_GET['id']; // note the quotes
Third, if your id field is numeric(int, etc., as it should be), the above query with the quotes will still run. It just won't do anything. Remove the quotes from numeric fields.
$query = "delete from table where id=" . $_GET['id'];
If $_GET['id'] is empty or not a number, your script will now error - which is what you really want, to alert you of the problem with input.
If you're still having trouble with it, do a lookup first (and these changes relate to the last comment below: )
$id = (isset($_GET['id']) and is_numeric($_GET['id') and ($_GET['id'] > 0))?:$_GET['id']:0;
if ($id > 0) {
$query = "select id from table where id=$id;
$result = mysql_query($query) or die("Cannot check for existing ID " . mysql_error());
if ($row = mysql_fetch_array($result)) {
$query = delete from table where id=$id;
mysql_query($query) or die("Cannot delete record with id $id ID " . mysql_error());
// Your redirect code here
}
else { echo "<p>There is no valid record with that id.</p>"; exit; }
}
else { echo "<p>Hmm. No valid id posted to script.<p>"; exit; }
If you're still having troubles, maybe your connected mysql user doesn't have delete privileges on the database.
Last, you should really look at cleansing your input and avoid using PHP_SELF (Google PHP_SELF vulnerabilities.) The approaches here are highly insecure.
