title: Remove Users Script
body: <p>I found this script for adding and deleting users on the internet and I tweaked it to make it work for my uses. I understand that this script is vulnerable to sql injection and that mysql_* is depreciated, but for my purposes it doesn't matter as this will never be released in a live environment.</p>
  
  <p>I am unable to delete any records. I also want to remove the add user functionality, for if a new user is to be created they can just use the registration page I have created.</p>
  
  <p>Here are the scripts:</p>
  
  <pre><code>&lt;?php //admin.php
  session_start();
  $user = $_SESSION['username'];
  include ("connection.php");
  
  $get = mysql_query ("SELECT * FROM Users WHERE username='$user'");
  while ($row = mysql_fetch_assoc($get))
  {
  $admin = $row['admin']; 
  }
  
  if ($admin==0)
  die("Your not an ADMIN!");
  ?&gt;
  </code></pre>
  
  <p>Next Script:</p>
  
  <pre><code>&lt;?php//conection.php
  $mysql_hostname = "localhost";
  $mysql_user = "root";
  $mysql_password = "";
  $mysql_database = "ninjaz_gaming";
  $prefix = "";
  $bd = mysql_connect($mysql_hostname, $mysql_user, $mysql_password) or die("Could not connect database");
  mysql_select_db($mysql_database, $bd) or die("Could not select database");
  ?&gt;
  </code></pre>
  
  <p>Remove and update users script:</p>
  
  <pre><code>&lt;?php//urmuser.php
  include('admin.php');
  include('connection.php');
  
  if (isset($_POST['id']) &amp;&amp;
  isset($_POST['username']) &amp;&amp;
  isset($_POST['password']) &amp;&amp;
  isset($_POST['email']) &amp;&amp;
  isset($_POST['birth']) &amp;&amp;
  isset($_POST['age']) &amp;&amp;
  isset($_POST['ircts3']) &amp;&amp;
  isset($_POST['game']) &amp;&amp;
  isset($_POST['gender']) &amp;&amp;
  isset($_POST['name']) &amp;&amp;
  isset($_POST['admin']))
  
  {
  $id = get_post('id');
  $username = get_post('username');
  $password = get_post(md5('password'));
  $email = get_post('email');
  $birth = get_post('birth');
  $age = get_post('age');
  $ircts3 = get_post('ircts3');
  $game = get_post('game');
  $gender = get_post('gender');
  $name = get_post('name');
  $administrator = get_post('admin');
  
  if (isset($_POST['delete']) &amp;&amp; $id != "") 
  {
  $query = "DELETE FROM Users WHERE id='$id'";
  
  if (!mysql_query($query, $bd))
  echo "DELETE failed: $query&lt;br /&gt;" .
  mysql_error() . "&lt;br /&gt;&lt;br /&gt;";
  }
  else
  {
  $query = "INSERT INTO Users VALUES" .
  "('$id', '$username', '$password', '$email', '$birth', '$age', '$ircts3', '$game',    '$gender', '$name'. '$administrator')";
  
  if (!mysql_query($query, $bd))
  echo "INSERT failed: $query&lt;br /&gt;" .
  mysql_error() . "&lt;br /&gt;&lt;br /&gt;";
  }
  }
  
  echo &lt;&lt;&lt;_END
  &lt;form action="urmuser.php" method="post"&gt;&lt;pre&gt;
  Id: &lt;input type="text" name="id" /&gt;
  Username: &lt;input type="text" name="username" /&gt;
  Password: &lt;input type="text" name="password" /&gt;
  E-mail: &lt;input type="text" name="email" /&gt;
  Birth Year: &lt;input type="text" name="birth" /&gt;
  Age: &lt;input type="text" name="age" /&gt;
  IRCTS3: &lt;input type="text" name="ircts3" /&gt;
  Game: &lt;input type="text" name="game" /&gt;
  Gender: &lt;input type="text" name="gender" /&gt;
  Name: &lt;input type="text" name="name" /&gt;
  Admin: &lt;input type="text" name="admin" /&gt;
  &lt;input type="submit" value="ADD USER" /&gt;
  &lt;/pre&gt;&lt;/form&gt;
  _END;
  
  $query = "SELECT * FROM Users";
  $result = mysql_query($query);
  
  if (!$result) die ("Database access failed: " . mysql_error());
  $rows = mysql_num_rows($result);
  
  for ($j = 0 ; $j &lt; $rows ; ++$j)
  {
  $row = mysql_fetch_row($result);
  echo &lt;&lt;&lt;_END
  &lt;pre&gt;
  Id: $row[0]
  Username: $row[1]
  Password: $row[2]
  Email: $row[3]
  Birth: $row[4]
  Age: $row[5]
  IRCTS3: $row[6]
  Fav Game: $row[7]
  Gender: $row[8]
  Name: $row[9]
  Admin: $row[10]
  &lt;/pre&gt;
  &lt;form action="urmuser.php" method="post"&gt;
  &lt;input type="hidden" name="delete" value="yes" /&gt;
  &lt;input type="hidden" name="id" value="$row[0]" /&gt;
  &lt;input type="submit" value="DELETE USER" /&gt;&lt;/form&gt;
  _END;
  }
  
  mysql_close($bd);
  
  function get_post($var)
  {
  return mysql_real_escape_string($_POST[$var]);
  }
  ?&gt;
  </code></pre>