Our current WordPress install has a few custom tables we've placed into the WP database that hold misc. information. We've created custom option pages for the WP admin panel for our WP admin users to be able to access the information from the DB through the admin.

One option we want is for users to be able to delete some of these records through the WP admin panel, so I've initially setup a custom query to just UPDATE or DELETE the records from the table. However, when I try to submit the query, WP returns the error: "You do not have sufficient permissions to access this page.".

Should I be avoiding the MySQL query "UPDATE table_name... etc."?

  • You shouldn't be avoiding it as such (at least for custom tables) - but the MySQL query shouldn't be returning the permissions error. How do you trigger the query? Is there a 'submit' button you are clicking? – Stephen Harris Feb 7 '12 at 22:39
  • Each table record also outputs a "Delete" link next to it. The delete link URL is set using <?php echo $_SERVER['SERVER_URI']; ?>/?deleteUser=XX... with XX obviously being the user's ID. From there, I have an if statement checking whether isset($_GET['deleteUser']) is called and then I run the query – cqde Feb 7 '12 at 23:13
  • The problem is the page $_SERVER['SERVER_URI'] - it seems that you do not have permission to access that page. Use firebug/dev tools - what is the url displaying as? – Stephen Harris Feb 7 '12 at 23:17
  • Whoops, meant "REQUEST_URI", which should just be returning the current URL in the address bar. – cqde Feb 7 '12 at 23:25
  • I actually removed the $_SERVER call altogether, using just "?deleteUser" and the query was successful. – cqde Feb 7 '12 at 23:27

I think the problem is that by just appending ?deleteUser=XX you get an 'illegal' url, for example:


Instead, use WordPress' add_query_arg:

    $url = $_SERVER['REQUEST_URI'];
    $url = add_query_arg('test','val',$url);

which gives:


Personally, I wouldn't use $_SERVER['REQUEST_URI']; and instead hard-code the url of the page using admin_url. Also, see @Joshua comments on using the WordPress in-built functions which handle sanitization of your SQL statements.

Final point, you will want to perform nonce-checks (as well permission checks - should the current user be able to delete/modify table?). For the nonce-check you can do:

 $url = wp_nonce_url( $url, 'my-nonce-action' );

to add the nonce to the url the user is directed to. Then prior to deleting/modifying anything, use wp_verify_nonce to verify the nonce.


Not sure about the permissioning, without more info, but you may want to try this: http://codex.wordpress.org/Class_Reference/wpdb#UPDATE_rows

Essentially its use is summed up as this:

    global $wpdb;
        $update_array = array(
            'column1' => 'value 1',
            'column2' => $value_2

        $where_array = array(
            'column 3' => 'value 3'

    $wpdb->update('table_name', $update_array, $where_array);

A quick idea for the permissioning, have you made the "update" page private and/or hidden?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.