SQL Injection and php performance checking I hope this is not a really bad question for a first time here beginner.

This piece of code selects from the left table and will list the content in the right hand table. This is a working code but I would like to see how a professional would protect and make it faster. 

Any suggestion (with some code) would be appreciated. Thanks a lot

PS: There is also a little glitch with it: after deleting it lose the selected item on the right list.

&lt;?php include("db_con1.php");?&gt;

&lt;html&gt;
&lt;head&gt;
&lt;/head&gt;
&lt;body&gt;
&lt;form method="post" action="test.php"&gt;

&lt;div id="left"&gt;
&lt;?php
  $queryl = $pdo-&gt;prepare('SELECT id, name FROM test1 ORDER BY name ASC');
  $queryl-&gt;execute();
?&gt;

&lt;ul&gt;

  &lt;?php foreach ($queryl as $i =&gt; $rowl) { ?&gt;

  &lt;li&gt;
   &lt;?php if ($i) {?&gt;
  &lt;input name="checkbox1_del[]" id="test_&lt;?php echo $i ?&gt;" type="checkbox" value="&lt;? echo $rowl['id']; ?&gt;"/&gt;
  &lt;label for="test_&lt;?php echo $i ?&gt;"&gt;
   &lt;a href="test1.php?gid=&lt;?php echo $rowl['id']; ?&gt;"&gt;&lt;?php echo $rowl['name']; ?&gt;&lt;/a&gt;
  &lt;/label&gt;
 &lt;/li&gt;
  &lt;?php } ?&gt;
 &lt;/ul&gt;
&lt;/div&gt;

&lt;div id="right"&gt;

&lt;?php
  if(isset($_GET['gid'])) {
   $gid=$_GET['gid'];    
   $queryr = $pdo-&gt;prepare('SELECT test3.name FROM test1, test2, test3 WHERE test1.id=test2.groupid AND test3.id=test2.peopleid AND test1.id='.$gid.' ORDER BY test3.name ASC');
   $queryr-&gt;execute();
  }
?&gt;

&lt;ul&gt;

  &lt;?php foreach ($queryr as $i =&gt; $rowr) { ?&gt;

    &lt;li&gt;
      &lt;?php if ($i) {?&gt;
      &lt;input name="checkbox2_del[]" id="test_&lt;?php echo $i ?&gt;" type="checkbox" value="&lt;? echo $rowr['id']; ?&gt;"/&gt;
      &lt;label for="test_&lt;?php echo $i ?&gt;"&gt;&lt;?php echo $rowr['name']; ?&gt;&lt;/label&gt;
    &lt;/li&gt;
  &lt;?php } ?&gt;
&lt;/ul&gt;
&lt;/div&gt;

&lt;input type="submit" name="del" value="Delete the selected items"&gt;
&lt;/form&gt;

&lt;?php
if (isset($_POST['del'])) {
echo "Don't delete:)";
  for ($c = 0; $c &lt; count($_POST['checkbox1_del']); $c++){
    $checkbox1_del = $_POST['checkbox1_del'][$c];
    $sql = 'UPDATE test1 SET status=0, log="'.date("Y-m-d").'"WHERE id='.$checkbox1_del;
    echo $sql;
    $query = $pdo-&gt;prepare($sql);
    $query-&gt;execute();
  }

  for ($c = 0; $c &lt; count($_POST['checkbox2_del']); $c++){
    $checkbox2_del = $_POST['checkbox2_del'][$c];
    $sql = 'UPDATE test2 SET status=0, log="'.date("Y-m-d").'"WHERE id='.$checkbox2_del;
    echo $sql;
    $query = $pdo-&gt;prepare($sql);
    $query-&gt;execute();
   }

    if($query){
      echo "&lt;meta http-equiv=\"refresh\" content=\"0;URL=test1.php\"&gt;";
     }
 }
?&gt;

&lt;/body&gt;
&lt;/html&gt;


Revise 1: This is a extracted part of my program, however here is the definition of this function:

Having 3-5000 contact, to send emails them easier to group them to Distribution list.
So this part of the program provide 3 tables:

Distribution list   |    Members of selected group   |   People

you can make group names and can add people into it.

So basic functions that I wrote for this part:


new distribution list can be added
By clicking on any Distribution list you'll get the Members table ($_GET)
Also by clicking on Distribution list should be BOLD (class="bold") as highlighted
Selecting any members in the member list can be deleted (checkbox2_del())
From people list anyone can be added to the list


This is what I tried to write and this test shows that basic steps of it. I just didn't want to overload  anybody to read through the whole script. If anyone would like to see I happy to replace with it. Thanks
You are using prepared SQL statements, but not using parameterised queries in them, so you're still wide open to SQL injections. This is how you should be doing it:

$gid = $_GET['gid'];    
$queryr = $pdo-&gt;prepare('SELECT test3.name FROM test1, test2, test3 WHERE test1.id = test2.groupid AND test3.id = test2.peopleid AND test1.id = :gid ORDER BY test3.name ASC');
$queryr-&gt;bindParam(':gid', $gid, PDO::PARAM_STR);
$queryr-&gt;execute();


Assuming that your $gid is supposed to be numeric, you should probably extract it this way too:

if(is_numeric($_GET['gid'])) {
  $gid = (int)$_GET['gid'];
  // ...
  $queryr-&gt;bindParam(':gid', $gid, PDO::PARAM_INT);


The same applies to your later queries that are being generated from $_POST.



This segment also seems to be missing a set of braces. If it works, then it's likely only a coincidence. if without braces is hard enough to read in just PHP, but if you drop out of PHP, I honestly have no idea how PHP will react.

  &lt;?php foreach ($queryl as $i =&gt; $rowl) { ?&gt;

  &lt;li&gt;
   &lt;?php if ($i)?&gt; &lt;!-- **** BRACES MISSING HERE? **** --&gt;
  &lt;input name="checkbox_del[]" id="test_&lt;?php echo $i ?&gt;" type="checkbox" value="&lt;? echo $rowl['id']; ?&gt;"/&gt;
  &lt;label for="test_&lt;?php echo $i ?&gt;"&gt;
   &lt;a href="test1.php?gid=&lt;?php echo $rowl['id']; ?&gt;"&gt;&lt;?php echo $rowl['name']; ?&gt;&lt;/a&gt;
  &lt;/label&gt;
 &lt;/li&gt;
  &lt;?php } ?&gt;




There is a larger problem with this script in general. Mixing logic with the output can cause design problems. Ideally you would load all your data at the top, then generate your page all at once. I don't know how big a system this is, but in general it's much easier to manage the system as a whole if you structure your pages this way. What happens if you want to conditionally show something at the top of the page, but the condition isn't generated till later when you are processing data?

Eg, you might end up with something like the following:

&lt;?php 
include("db_con1.php");
$queryl = $pdo-&gt;prepare('SELECT id, name FROM test1 ORDER BY name ASC');
$queryl-&gt;execute();

$lists = array();
while (($rowl = $queryl-&gt;fetch(PDO::FETCH_ASSOC)) !== false) {
  $lists[] = $rowl;
}

// And so on for all the data you need to load
?&gt;
&lt;html&gt;
&lt;head&gt;
&lt;!-- And so on... --&gt;


It seems your right bar and left bar aren't associated directly, but if they were then you could put more in that while loop to load stuff into $rowl before adding it to $lists. You can then just iterate over this array in your code. All your SQL is at the top of the file and easy to change, all your presentation is at the bottom of the file and will read a lot nicer too, with just some loops and some echo's.