HTTP Delete Request to MYSQL with user ID variable

Kasia Kaplińska :

Hi I am trying to delete a record from a table within MYSQL database with a where clause. this is what I have so far but its not working, and im not sure how to go about it. Is there a way to make this work? I have included my delete method and php file code.

my URL -

 deleteCompletedGoal=("http://10.0.2.2/deleteCompletedGoalAddress.php?user_goal_id="+completed_goalID);

my code -

 private void deleteNonActiveGoal(){
        try {
            URL url = new URL(deleteCompletedGoal);
            HttpURLConnection http = (HttpURLConnection) url.openConnection();
            http.setRequestMethod("POST");
            http.setRequestProperty("X-HTTP-Method-Override", "DELETE");
            http.setDoInput(true);
            http.setDoOutput(true);

            OutputStream ops = http.getOutputStream();
            BufferedWriter writer = new BufferedWriter(new OutputStreamWriter(ops, "UTF-8"));
            String data = URLEncoder.encode("user_goal_id", "UTF-8") + "=" + URLEncoder.encode(completed_goalID, "UTF-8") + "&&";

            writer.write(data);
            writer.flush();
            writer.close();
            ops.close();

            InputStream ips = http.getInputStream();
            BufferedReader reader = new BufferedReader(new InputStreamReader(ips, "ISO-8859-1"));

            String line;
            while ((line = reader.readLine()) != null) {
                result += line;
            }
            reader.close();
            ips.close();
            http.disconnect();

        }
        catch (MalformedURLException e) {
            result = e.getMessage();
        } catch (IOException e) {
            result = e.getMessage();
        }

    }

PHP file:

<?php
require "connection.php";

$completed_goalID=$_POST["user_goal_id"];


$mysql_qry = "DELETE from user_goals WHERE user_goal_id ='$completed_goalID'";

if($conn->query($mysql_qry) === TRUE) {
echo "delete successful";
}
else{
echo "delete failed";
}
$conn->close();
?>

Jay Blanchard :

Since you are sending the variable in the query string you would use GET instead of POST. Change:

 $completed_goalID=$_POST["user_goal_id"];

$completed_goalID=$_GET["user_goal_id"];

WARNING

Little Bobby says your script is at risk for SQL Injection Attacks. Learn about prepared statements for MySQLi. Even escaping the string is not safe!

HTTP Delete Request to MYSQL with user ID variable

Guess you like