php - DELETE mutiples table doesn't work -
$sql = "delete t1, t2, t3, t4, t5, t6, t7 bla1 t1, bla2 t2, bla3 t3, bla4 t4, bla5 t5, bla6 t6, bla7 t7 t1.id = t2.id , t2.id = t3.id , t3.id = t4.id , t4.id = t5.id , t5.id = t6.id , t6.id = t7.id , t1.id = {$_get["id"]}";
ok, i'll bite.
you've got sql injection hole in code
here:
t1.id = {$_get["id"]}"; <<-- never inject php `get` sql!
see answers question: how can prevent sql injection in php?
if want webmaster, knowing sql-injection , xss 2 important things.
learn 2 things , you'll have happy customers.
back business:
mysql delete
have syntax error in delete
statement.
delete not follow same syntax select
.
select selects columns, delete works on rows, it's mix of metaphors mention columns in delete
statement.
see here correct syntax: http://dev.mysql.com/doc/refman/5.5/en/delete.html
because did not explain in question intended do, i'll have guess. looks tying multi-table delete.
e.g. deleting rows multiple interlinked tables.
how , why tables interlinked important, did not state i'll have guess.
multi-table delete manual:
delete [low_priority] [quick] [ignore]
tbl_name[.] [, tbl_name[.]] ...
table_references
[where where_condition]
$stmt = $pdo->prepare('delete t1, t2, t3, t4, t5, t6, t7 (t1.id = t2.id) , (t2.id = t3.id) , (t3.id = t4.id) , (t4.id = t5.id) , (t5.id = t6.id) , (t6.id = t7.id) , (t1.id = :id'); $id = get["id"]; $stmt->execute(array(':id' => $id));
note because you're using mysql pdo, immune sql-injection.
see here on info prepared data objects pdo
Comments
Post a Comment