使用用户ID变量向MYSQL发送HTTP删除请求

Question

嗨，我正试图用where子句从MYSQL数据库中的表中删除一条记录。这就是我目前所做的，但不起作用，我不知道该怎么做。有办法让它起作用吗？我已经包含了我的删除方法和php文件代码。

我的URL-

deleteCompletedGoal=("http://10.0.2.2/deleteCompletedGoalAddress.php?user_goal_id="+completed_goalID);

我的代码-

private void deleteNonActiveGoal(){
try {
URL url = new URL(deleteCompletedGoal);
HttpURLConnection http = (HttpURLConnection) url.openConnection();
http.setRequestMethod("POST");
http.setRequestProperty("X-HTTP-Method-Override", "DELETE");
http.setDoInput(true);
http.setDoOutput(true);
OutputStream ops = http.getOutputStream();
BufferedWriter writer = new BufferedWriter(new OutputStreamWriter(ops, "UTF-8"));
String data = URLEncoder.encode("user_goal_id", "UTF-8") + "=" + URLEncoder.encode(completed_goalID, "UTF-8") + "&&";
writer.write(data);
writer.flush();
writer.close();
ops.close();
InputStream ips = http.getInputStream();
BufferedReader reader = new BufferedReader(new InputStreamReader(ips, "ISO-8859-1"));
String line;
while ((line = reader.readLine()) != null) {
result += line;
}
reader.close();
ips.close();
http.disconnect();
}
catch (MalformedURLException e) {
result = e.getMessage();
} catch (IOException e) {
result = e.getMessage();
}
}

PHP文件：

<?php
require "connection.php";
$completed_goalID=$_POST["user_goal_id"];

$mysql_qry = "DELETE from user_goals WHERE user_goal_id ='$completed_goalID'";
if($conn->query($mysql_qry) === TRUE) {
echo "delete successful";
}
else{
echo "delete failed";
}
$conn->close();
?>

Answer 1

由于您在查询字符串中发送变量，因此您将使用GET而不是POST。更改：

$completed_goalID=$_POST["user_goal_id"];

至

$completed_goalID=$_GET["user_goal_id"];

警告

Little Bobby说您的脚本有SQL注入攻击的风险了解MySQLi的准备语句。即使逃离绳子也不安全！

Answer 2

对url中的catch变量使用$_GET，如：

$completed_goalID=$_GET["user_goal_id"];

更改查询以防止sql攻击(参考(，如：

<?php
require "connection.php";
$completed_goalID=$_POST["user_goal_id"];

$mysql_qry = $conn->prepare("DELETE from user_goals WHERE user_goal_id=?");
$mysql_qry->bind_param('i',$completed_goalID);
if($mysql_qry->execute() === TRUE){
echo "delete successful";
}
else{
echo "delete failed";
}
$mysql_qry->close();
$conn->close();
?>