使用Angular和PHP删除数据

Question

我想用PHP和Angular形式的MySQL删除数据。 这是我的代码：

角

    $scope.delete = function(){
    that = this;
    $http.get("delete.php").success(function(data){
        $scope.users.splice(that.$index, 1)
    })
}

PHP

$data = json_decode(file_get_contents("php://input"));
$subject = mysql_real_escape_string($data->subject);
mysql_select_db("angular") or die(mysql_error());

$tbl="Customers";
$subject = $_GET ['index'];
$sql="DELETE FROM $tbl WHERE subject = '$subject'";
$result = mysql_query($sql, $con);
if($result){
    echo "Deleted Successfully";

}else {
    echo "ERROR";
}  

DB

I have a table "Customers" with subject and body cell

JavaScript代码工作正常，但刷新数据后仍然活着!!
我哪里错了？

Answer 1

如评论中所述，您的代码易受攻击到SQL注入攻击

---

您需要在请求中添加subject

<强>角

$scope.delete = function(){
var subject = // get subject somehow ...
that = this;
$http.get("delete.php?subject=" + subject)
   .success(function(data){
       $scope.users.splice(that.$index, 1)
    })
}  

<强> PHP

$tbl="Customers";
$subject = $_GET ['subject'];
$sql="DELETE FROM $tbl WHERE subject = '$subject'";
$result = mysql_query($sql, $con);
if($result){
    echo "Deleted Successfully";

}else {
    echo "ERROR";
}