Results 1 to 6 of 6
  1. #1
    Join Date
    Sep 2006
    Location
    Evanston, Illinois.
    Posts
    2,361
    Tokens
    0

    Latest Awards:

    Default Is this correct syntax?

    I know it's bad practice to use tables for users, but ah well, here it is this is to delete a user.

    PHP Code:
    <?php

    $user 
    $_GET['user'];
    $sql_a mysql_query("DROP" .$user"table IF EXISTS");
    $sql_b mysql_query("DELETE * FROM users WHERE user='$user'");

    if(
    $sql_a) {
        if(
    $sql_b {
        echo 
    "" .$user"successfully deleted!";
        }
    }
    ?>
    How could this hapen to meeeeeeeeeeeeeee?lol.

  2. #2
    Join Date
    Sep 2006
    Location
    Evanston, Illinois.
    Posts
    2,361
    Tokens
    0

    Latest Awards:

    Default

    edit change.
    How could this hapen to meeeeeeeeeeeeeee?lol.

  3. #3
    Join Date
    Oct 2006
    Location
    Peterborough, UK
    Posts
    3,855
    Tokens
    216

    Latest Awards:

    Default

    PHP Code:
    <?php
    if( mysql_query"DELETE FROM `users` WHERE lcase( `user` ) = lcase( '" htmlentities$userENT_QUOTES ) . "' )" ) )
    {
        echo( 
    "Jews in the oven." );
    }
    ?>


    visit my internet web site on the internet
    http://dong.engineer/
    it is just videos by bill wurtz videos you have been warned

  4. #4
    Join Date
    Jan 2007
    Location
    Canada eh?
    Posts
    766
    Tokens
    75

    Default

    PHP Code:
    <?php
    $user 
    $_GET['user'];
    $sql_a mysql_query("DROP `".$user."table` IF EXISTS");
    $sql_b mysql_query("DELETE * FROM `users `WHERE `user` = '".$user."'");
    if(
    $sql_a&&$sql_b){
        echo 
    $user" successfully deleted!";
    }
    ?>
    OR (like dan did)

    PHP Code:
    <?php
    $user 
    $_GET['user'];
    if(
    mysql_query("DROP `".$user."table` IF EXISTS")&&mysql_query("DELETE * FROM `users `WHERE `user` = '".$user."'")){
        echo 
    $user" successfully deleted!";
    }
    ?>
    My only other suggestion would be to make sure that you run some sort of cleaning function on $_GET['user'] before you use it directly in a MySQL query. If not it could lead to major security vulnerabilities.

  5. #5
    Join Date
    Sep 2006
    Location
    Evanston, Illinois.
    Posts
    2,361
    Tokens
    0

    Latest Awards:

    Default

    I already reverted to better coding, not using tables, as it is mainly a waste, and confusing for searches etc.
    How could this hapen to meeeeeeeeeeeeeee?lol.

  6. #6
    Join Date
    Jan 2007
    Location
    Canada eh?
    Posts
    766
    Tokens
    75

    Default

    Quote Originally Posted by Reconix View Post
    I already reverted to better coding, not using tables, as it is mainly a waste, and confusing for searches etc.
    Well using tables is fine, just not if you have a seperate table for every user.... that becomes a bit ridiculous. Generally what you do is make one 'user' table with certains fields and then every new user is a new row in the table. That way it is much easier to edit fieldnames, keep track of total users and etc.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •