undefined index error

[leesyaa]

This is going to sound really stupid, but I cannot figure out why I am getting this error.

Undefined index: bil in C:\wamp\www\FORM\deleteadmin.php on line 4
 
Undefined index: adminID in C:\wamp\www\FORM\deleteadmin.php on line 5

line 4 and 5 looks like this,

$bil = $_POST['bil'];
$adminID = $_POST['adminID'];

the full code are new.php which links to the deleteadmin.php that contains the error.

new.php

echo "<form name='update $bil' method=post action=newuser.php>" ?>
    <tr>
        <td><center><?php echo $bil; ?></center></td>
        <td><?php echo $row['name']; ?></td>
        <td><?php echo $row['tel']; ?></td>
        <td><?php echo $row['email']; ?></td>
        <td><?php echo $row['username']; ?></td>
        <td><?php echo $row['password']; ?></td>
        <td><a href = "deleteadmin.php"><img src="img/deleteicon.png" align="center"></a></td>
        <input type=hidden value={$row['adminID']} name=adminID>
        <input type=hidden value=$bil name=bil>
    </tr>
<?php 
    echo "</form>";
}
?>

deleteadmin.php

<?php
include ('config.php');
 
$bil = $_POST['bil'];
$adminID = $_POST['adminID'];
 
$result = mysql_query("DELETE FROM `admin` WHERE `adminID`= '$adminID'") or die (mysql_error());
 
if($result)
{
?>
<script language="javascript">
alert("User No : <?php echo "$bil"; ?> DELETED");
location.href="new.php";
</script>
 
<?php
}
else
{
?>
 
<script language="javascript">
alert("User No : <?php echo "$bil"; ?> NOT DELETED");
location.href="new.php";
</script>
<?php
}
?>

What do I need to do to fix them?
I don't understand why this is happening, and I'd love to know how to make it go away.

[Dormilich]

the problem is that you have a link and not a submit button. you can simply combine button and image like:

<button type="submit">
    <img src="…">
</button>

[leesyaa]

I figured this do the trick!

<td><a href = "deleteadmin.php?adminID=<?php echo $row['adminID']; ?>&bil=<?php echo $bil; ?>"><img src="img/deleteicon.png" align="center"></a></td>

[Dormilich]

well, if you‘re fine with using GET instead of POST … (and the fact that GET requests get cached)

[leesyaa]

less secure? hmm maybe this :D

$sql = "DELETE FROM admin WHERE md5(adminID)= '".md5($adminID)."'";

[Dormilich]

that doesn‘t change the fact that both values are plainly visible on transmission. when they are on your server, they have reached the "secure" spot.