This question already has an answer here:
I keep receiving this error when deleting a record form a table. The record does get deleted by the database but the php page handling the delete fails. I have gone over the code line by line and do not understand why I keep receiving the error: failed because of: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1' at line 1
<?php
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "dbname";
$idSched = $_GET['idSched'];
$conn = new mysqli($servername, $username, $password, $dbname);
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
$sql = mysqli_query($conn, "DELETE FROM schedule_master WHERE idSched='$idSched'");
if (mysqli_query($conn,$sql))
header('refresh:1; url=schedule_main_edit.php');
else
echo "failed because of: " . mysqli_error($conn);
?>
</div>
What you want to do is use prepared statements to prevent sql injections. This is a good idea but it would work a bit differently:
$stmt = $con->prepare("DELETE FROM schedule_master WHERE idSched = ?");
$stmt->bind_param("i", $idSched); // where "i" is for int
$stmt->execute();
$stmt->close();
This would work but I would much rather use a database wrapper of some sort that does the binding for you. This way you would be writing less code. I cannot recommend one without knowing what framework you are using, but most of them already have these wrappers build-in or have extensions that can be easily installed.