Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Our current WordPress install has a few custom tables we've placed into the WP database that hold misc. information. We've created custom option pages for the WP admin panel for our WP admin users to be able to access the information from the DB through the admin.

One option we want is for users to be able to delete some of these records through the WP admin panel, so I've initially setup a custom query to just UPDATE or DELETE the records from the table. However, when I try to submit the query, WP returns the error: "You do not have sufficient permissions to access this page.".

Should I be avoiding the MySQL query "UPDATE table_name... etc."?

share|improve this question
    
You shouldn't be avoiding it as such (at least for custom tables) - but the MySQL query shouldn't be returning the permissions error. How do you trigger the query? Is there a 'submit' button you are clicking? –  Stephen Harris Feb 7 '12 at 22:39
    
Each table record also outputs a "Delete" link next to it. The delete link URL is set using <?php echo $_SERVER['SERVER_URI']; ?>/?deleteUser=XX... with XX obviously being the user's ID. From there, I have an if statement checking whether isset($_GET['deleteUser']) is called and then I run the query –  cqde Feb 7 '12 at 23:13
    
The problem is the page $_SERVER['SERVER_URI'] - it seems that you do not have permission to access that page. Use firebug/dev tools - what is the url displaying as? –  Stephen Harris Feb 7 '12 at 23:17
    
Whoops, meant "REQUEST_URI", which should just be returning the current URL in the address bar. –  cqde Feb 7 '12 at 23:25
    
I actually removed the $_SERVER call altogether, using just "?deleteUser" and the query was successful. –  cqde Feb 7 '12 at 23:27

2 Answers 2

I think the problem is that by just appending ?deleteUser=XX you get an 'illegal' url, for example:

http://localhost/wordpress/wp-admin/edit.php?post_type=type&page=mypage?deleteUser=xxx

Instead, use WordPress' add_query_arg:

    $url = $_SERVER['REQUEST_URI'];
    $url = add_query_arg('test','val',$url);

which gives:

http://localhost/wordpress/wp-admin/edit.php?post_type=type&page=mypage&deleteUser=xxx

Personally, I wouldn't use $_SERVER['REQUEST_URI']; and instead hard-code the url of the page using admin_url. Also, see @Joshua comments on using the WordPress in-built functions which handle sanitization of your SQL statements.

Final point, you will want to perform nonce-checks (as well permission checks - should the current user be able to delete/modify table?). For the nonce-check you can do:

 $url = wp_nonce_url( $url, 'my-nonce-action' );

to add the nonce to the url the user is directed to. Then prior to deleting/modifying anything, use wp_verify_nonce to verify the nonce.

share|improve this answer

Not sure about the permissioning, without more info, but you may want to try this: http://codex.wordpress.org/Class_Reference/wpdb#UPDATE_rows

Essentially its use is summed up as this:

<?php
    global $wpdb;
        $update_array = array(
            'column1' => 'value 1',
            'column2' => $value_2
        );

        $where_array = array(
            'column 3' => 'value 3'
        );

    $wpdb->update('table_name', $update_array, $where_array);
?>

A quick idea for the permissioning, have you made the "update" page private and/or hidden?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.