No such ID?
Your HTML is poorly formed: you're using XHTML syntax. It may be that you have decided to drop support for IE and really are using XHTML, but I'll assume you've simply failed to understand the ramifications of using it, as so many people do, and are serving it as HTML. The <meta> element can only go in the <head>, but the <div> can only go in the <body>; and a <p> would be more semantically appropriate here.
Dropping out of PHP parsing mode makes for more efficient and more readable PHP, as well as neater HTML.
Looping here is needlessly inefficient: do it in a single query with the SQL IN operator.
I'm again going to be pessimistic and assume that you've forgotten to escape the input from the checkboxes. If you haven't, remove the array_map() call, or it'll muck things up.
Code:
else if (isset($_POST['delete'])) {
if ($level >= 18) {
$del = mysql_query(sprintf('DELETE FROM members WHERE id IN ('%s')',
implode('\', \'', array_map('mysql_real_escape_string', $checkbox)))
)
or die(sprintf('<p>Query failed:</p><p>%s</p>', mysql_error()));
?>
<meta http-equiv="refresh" content="2;URL=<?php echo $_SERVER['PHP_SELF']; ?>">
</head>
<body>
<p class="message">The selected users have been deleted.</p>
<?php } else { ?>
<meta http-equiv="refresh" content="2;URL=<?php echo $_SERVER['PHP_SELF']; ?>">
</head>
<body>
<p class="error">You do not have permission to remove members</p>
<?php
}
}
Bookmarks