Deleting a database row with mysql - getting an error!?

Question

Here's the code:

mysql_query("DELETE " . $_GET['id'] . " FROM forum_favorites WHERE thread_id='" . $_GET['id'] . "' AND user='" . $userinfo['username'] . "'") or die(mysql_error());

And the error message:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '77 FROM forum_favorites WHERE thread_id='77' AND user='nike1'' at line 1

Anyone knows what's up here? I've been stuck here for hours now and i just can't figure out what the heck's wrong? The database name and the column names are correct.

Thanks. -Nike

Answer 1

Remove " . $_GET['id'] . " between DELETE and FROM:

DELETE FROM forum_favorites etc...

See the documentation for DELETE for more information.

Note that your code may also be vulnerable to SQL injection attacks. I'd suggest reading this question and the answers there.

Answer 2

$thread_id=intval($_GET['id']);
$username=mysql_real_escpe_string($userinfo['username']);

$sql="DELETE FROM forum_favorites WHERE thread_id=$thread_id AND user='$username'";
mysql_query($sql) or trigger_error(mysql_error());