# PHP/MySQL and deleting

**URL:** <https://boards.straightdope.com/t/php-mysql-and-deleting/156469>\
**Category:** Factual Questions\
**Created:** [February 21, 2003, 3:18am UTC](https://boards.straightdope.com/t/php-mysql-and-deleting/156469 "2003-02-21T03:18:39Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![cykrider](https://avatars.discourse-cdn.com/v4/letter/c/f19dbf/32.png) [@cykrider](https://boards.straightdope.com/u/cykrider)\
**Post date:** [February 21, 2003, 3:18am UTC](https://boards.straightdope.com/t/php-mysql-and-deleting/156469/1 "2003-02-21T03:18:39Z")

</div>

I’m tearing my hair out trying to figure out why this wont work. I get a variable (the name of a table) via the querystring and I want to delete the name from a user table. For example, without the querystring variables it would look like:

mysql\_query("DELETE FROM cykrider WHERE testname=‘mytest’ ");  
echo mysql\_error();  
(This works)

However, when I put mytest as a  
variable (testnam), I get an error:

mysql\_query("DELETE FROM $usersname WHERE testname=’$testnam’ ");  
echo mysql\_error();

I’ve tried changing it to:  
WHERE testname = ‘$testnam’ ");

but that didn’t seem to work either. Any ideas? Thanks.

---

<div class="post-metadata">

**Author:** ![Q.E.D](https://avatars.discourse-cdn.com/v4/letter/q/51bf81/32.png) [@Q.E.D](https://boards.straightdope.com/u/Q.E.D)\
**Post date:** [February 21, 2003, 3:22am UTC](https://boards.straightdope.com/t/php-mysql-and-deleting/156469/2 "2003-02-21T03:22:36Z")

</div>

Lose the single quotes. IIRC, MySQL treats everything in single quotes as a literal.

---

<div class="post-metadata">

**Author:** ![Hilow](https://avatars.discourse-cdn.com/v4/letter/h/c4cdca/32.png) [@Hilow](https://boards.straightdope.com/u/Hilow)\
**Post date:** [February 21, 2003, 3:30am UTC](https://boards.straightdope.com/t/php-mysql-and-deleting/156469/3 "2003-02-21T03:30:18Z")

</div>

Try “Delete From " + $usersname + " where testname=’” + $testnam + “’” inside of the mysql\_query parenthesis

Note that ‘’’ is actually a single quote followed by a double quote and “’” is actualy a single quote inside of two double quotes.

This also assumes you concatenate strings in PHP using the plus sign. If not replace the + with the appropriate symbol.

---

<div class="post-metadata">

**Author:** ![Q.E.D](https://avatars.discourse-cdn.com/v4/letter/q/51bf81/32.png) [@Q.E.D](https://boards.straightdope.com/u/Q.E.D)\
**Post date:** [February 21, 2003, 4:06am UTC](https://boards.straightdope.com/t/php-mysql-and-deleting/156469/4 "2003-02-21T04:06:23Z")

</div>

Try this:

mysql\_query("DELETE FROM ‘$usersname’ WHERE testname=’$testnam’ ");

$username is the name of the table? I’m not sure why it needs to be a variable. Does each $username have its own table?

I looked over my old PHP hacks I did for tForum a while back, and the single quotes are needed around string variables.

---

<div class="post-metadata">

**Author:** ![Trigonal\_Planar](https://avatars.discourse-cdn.com/v4/letter/t/0ea827/32.png) [@Trigonal\_Planar](https://boards.straightdope.com/u/Trigonal_Planar)\
**Post date:** [February 21, 2003, 4:12am UTC](https://boards.straightdope.com/t/php-mysql-and-deleting/156469/5 "2003-02-21T04:12:23Z")

</div>

Yes, QED is correct. Anything within quotes is taken literal.

---

<div class="post-metadata">

**Author:** ![cykrider](https://avatars.discourse-cdn.com/v4/letter/c/f19dbf/32.png) [@cykrider](https://boards.straightdope.com/u/cykrider)\
**Post date:** [February 21, 2003, 4:54am UTC](https://boards.straightdope.com/t/php-mysql-and-deleting/156469/6 "2003-02-21T04:54:18Z")

</div>

Sadly these haven’t worked either. Maybe if I show you the whole code it will make more sense.  
\<?  
session\_start(); //this has $username registered  
$HTTP\_GET\_VARS[‘testnam’];  
[connect and selete db here]  
##this will actually delete the test and send them back to the menu.  
##drop the table testname and delete the testname from the user.  
?\>  
\<html\>  
\<body\>  
\<?  
##mysql\_query(“drop table $testnam”);  
##echo mysql\_error(); //this worked and i took it out for debuging  
mysql\_query(“DELETE FROM $usersname WHERE testname=$testnam”);  
echo mysql\_error();

print\<\<\<E  
\<script language=“javascript”\>  
\<!–

java stuff here

–\>  
\</script\>

E;  
?\>  
\</body\>  
\</html\>

’ “.$testnam.” ’ seemed to give me the desired result of ‘test’ yet I still get the error: You have an error in your SQL syntax near 'WHERE testname=‘yourmom’ ’ at line 1

---

<div class="post-metadata">

**Author:** ![Tom\_P](https://avatars.discourse-cdn.com/v4/letter/t/7993a0/32.png) [@Tom\_P](https://boards.straightdope.com/u/Tom_P)\
**Post date:** [February 21, 2003, 9:03am UTC](https://boards.straightdope.com/t/php-mysql-and-deleting/156469/7 "2003-02-21T09:03:58Z")

</div>

The following code works for me:

```auto

mysql_query("DELETE FROM $username WHERE testname='$testnam'") or die(mysql_error());

```

In other words, put the field value within single quotes but not the table name. Depending on your version of PHP, you might also want to try this:

```auto

mysql_query("DELETE FROM $username WHERE testname='".$testnam."'") or die(mysql_error());

```

---

<div class="post-metadata">

**Author:** ![Tom\_P](https://avatars.discourse-cdn.com/v4/letter/t/7993a0/32.png) [@Tom\_P](https://boards.straightdope.com/u/Tom_P)\
**Post date:** [February 21, 2003, 9:08am UTC](https://boards.straightdope.com/t/php-mysql-and-deleting/156469/8 "2003-02-21T09:08:19Z")

</div>

Sorry for the double-post, but I also see that you first have a line reading:

```auto

session_start(); //this has **$username** registered

```

Then later

```auto

mysql_query("DELETE FROM **$usersname** WHERE testname=$testnam");

```

Is this just a typo in your post (or comment), or do you have the same names in your code?

---

<div class="post-metadata">

**Author:** ![cykrider](https://avatars.discourse-cdn.com/v4/letter/c/f19dbf/32.png) [@cykrider](https://boards.straightdope.com/u/cykrider)\
**Post date:** [February 21, 2003, 3:25pm UTC](https://boards.straightdope.com/t/php-mysql-and-deleting/156469/9 "2003-02-21T15:25:34Z")

</div>

Not really sure, b/c I swore I tried this 6 or 7 times, but this:  
mysql\_query(“DELETE FROM $username WHERE testname=’”.$testnam."’ ");  
echo mysql\_error();

managed to get it working. Thanks for all your help.

---

<div class="post-metadata">

**Author:** ![bryanmcc](https://avatars.discourse-cdn.com/v4/letter/b/eada6e/32.png) [@bryanmcc](https://boards.straightdope.com/u/bryanmcc)\
**Post date:** [February 21, 2003, 4:56pm UTC](https://boards.straightdope.com/t/php-mysql-and-deleting/156469/10 "2003-02-21T16:56:06Z")

</div>

you could probably also use ‘{$testname}’ (i.e., put the variable name inside curly braces inside the single quotes). PHP uses the curly braces to resolve confusing quotation mark situations, if I recall correctly.

-b

---

<div class="post-metadata">

**Author:** ![K3v1n](https://avatars.discourse-cdn.com/v4/letter/k/b19c9b/32.png) [@K3v1n](https://boards.straightdope.com/u/K3v1n)\
**Post date:** [February 22, 2003, 5:45am UTC](https://boards.straightdope.com/t/php-mysql-and-deleting/156469/11 "2003-02-22T05:45:46Z")

</div>

If REGISTER\_GLOBALS is off, which it probably is you’ll have to do this…

$testnam = $HTTP\_GET\_VARS[‘testnam’];

somewhere before:

mysql\_query(“DELETE FROM $usersname WHERE testname=$testnam”);

orrrr

Change it to:

mysql\_query(“DELETE FROM $usersname WHERE testname=” . $HTTP\_GET\_VARS[‘testnam’]);

---

<div class="post-metadata">

**Author:** ![NotMrKnowItAll](https://avatars.discourse-cdn.com/v4/letter/n/6bbea6/32.png) [@NotMrKnowItAll](https://boards.straightdope.com/u/NotMrKnowItAll)\
**Post date:** [February 22, 2003, 2:58pm UTC](https://boards.straightdope.com/t/php-mysql-and-deleting/156469/12 "2003-02-22T14:58:19Z")

</div>

Does MySQL in PHP not support bind variables?

> [@](#):
>
> mysql\_query(“DELETE FROM $username WHERE testname=’”.$testnam."’ ");

builds a string for the database to parse and execute. What If I as a user figures out how to set $testname to (play close attention to the single quotes):

```auto

$testname="anything' or 'a'='a"

```

so that the quoted mysql\_query(…) above resolves to(assuming $username=‘Evil\_User’):

```auto

DELETE FROM Evil_User WHERE testname='anything' or '1'='1'

```

That would delete all records from the table named Evil\_User.

Oracle for one, caches SQL statements and doesn’t waste time reparsing exact ones, using bind varibles (except that $username bit), actually speeds things up in future runs.