PHP删除MySQL数据及文件夹文件时遇unlink权限拒绝问题求助

Hey there, let's work through that unlink() permission error you're hitting. I've dealt with this exact scenario plenty of times, so here's a breakdown of the most common fixes plus a couple of code improvements to keep things secure.

First, Quick Code Typo Fix (Critical Even If Not Permission-Related) #

I spotted a small mistake in your code that might be contributing to the issue:

$row1=mysql_fetch_array($query1);
$image=$row["image_name"]; // Should be $row1["image_name"], not $row!

This typo could make $image empty, which would cause unlink() to try deleting the folder itself instead of a specific file — that’s likely part of why you’re seeing the permission denied error. Fix this first to ensure you’re targeting the right file.

Resolving the Permission Denied Error #

The core problem is that your web server doesn’t have the necessary permissions to delete files in the ../images/photos_faculty/ directory. Here’s how to fix it based on your operating system:

For Linux/Unix Servers #

Most web servers (Apache, Nginx) run as a dedicated user like www-data (Debian/Ubuntu) or apache (CentOS/RHEL). Follow these steps:

1. Check which user your web server runs as:
   Run this command in your terminal:

   ps aux | grep apache # For Apache
   # OR
   ps aux | grep nginx  # For Nginx
   

   Look for the user column (usually the 3rd column) — that’s the account your server uses to access files.

2. Assign folder ownership to the web server user:
   Replace www-data with the user you found in step 1:

   sudo chown -R www-data:www-data ../images/photos_faculty/
   

   This gives the web server full control over the folder and its contents.

3. Set secure file permissions:
   Ensure the folder has write permissions for the owner (avoid 777 — it’s a major security risk):

   sudo chmod -R 755 ../images/photos_faculty/
   

If You’re Using SELinux (CentOS/RHEL/Fedora) #

SELinux often blocks web server file operations even when Unix permissions look correct. Try these steps:

1. Test if SELinux is the culprit:
   Temporarily disable SELinux to confirm:

   sudo setenforce 0
   

   Run your delete script again. If it works, SELinux was the issue.

2. Set permanent SELinux permissions:
   Don’t leave SELinux disabled — instead, configure it to allow the web server access:

   sudo semanage fcontext -a -t httpd_sys_rw_content_t "../images/photos_faculty(/.*)?"
   sudo restorecon -Rv ../images/photos_faculty/
   

   This tells SELinux the web server is allowed to read and write files in that folder.

For Windows Servers (IIS) #

If you’re running IIS, the web server uses the IUSR or IIS_IUSRS group. Follow these steps:

1. Right-click the photos_faculty folder, select Properties → Security tab.
2. Click Edit → Add, type IIS_IUSRS (or IUSR) and click Check Names → OK.
3. Grant the group Modify permissions (which includes delete access) and click Apply.

Extra Security & Code Improvements #

Your current code uses deprecated mysql_* functions and is vulnerable to SQL injection. Here’s a safer rewrite using mysqli with prepared statements:

<?php
if (isset($_GET['delete'], $_GET['empid'])) {
    include("config.php");
    // Assuming $conn is a mysqli connection in config.php
    $empid = $_GET['empid'];
    
    // Fetch image name securely
    $stmt = $conn->prepare("SELECT image_name FROM faculty WHERE empid = ?");
    $stmt->bind_param("s", $empid);
    $stmt->execute();
    $result = $stmt->get_result();
    $row = $result->fetch_assoc();
    
    if ($row) {
        $image = $row['image_name'];
        $filePath = "../images/photos_faculty/" . $image;
        // Check if file exists before attempting deletion
        if (file_exists($filePath)) {
            unlink($filePath);
        }
    }
    
    // Delete database record securely
    $stmt = $conn->prepare("DELETE FROM faculty WHERE empid = ?");
    $stmt->bind_param("s", $empid);
    
    if ($stmt->execute()) {
        echo 'Data Deleted';
    } else {
        echo 'Data Not Deleted';
    }
    
    $conn->close();
}
?>

内容的提问来源于stack exchange，提问作者Rahul Kumar Sharma