invisio v2.0

<?php
    session_start();
    include('../../../config/main_function.php');
    $secure = "cAh3DrJACzw4RbU";
    $connection = connectDB($secure);

$document_id =  mysqli_real_escape_string($connection, $_POST['document_id']);

if ($connection) {
        
        $password = 'sd32f43q5we';
        $xapi = 'CXgvsdf542sdfg';
        $decryptedMessage = mysqli_real_escape_string($connection, $_POST['decryptedMessage']);

if (decryptMessage($decryptedMessage, $password) == $xapi) {

$sql = "SELECT * FROM tbl_member_document WHERE document_id = '$document_id'";
            $res = mysqli_query($connection, $sql);
            $row = mysqli_fetch_assoc($res);

$file_name = $row['document_file_name'];
            unlink('../../../main/upload/join/file/' . $file_name);

$sql_delete = "DELETE FROM tbl_member_document WHERE document_id = '$document_id'";

$res_delete = mysqli_query($connection, $sql_delete)  or die($connection->error);

if ($res_delete) {
                $arr['result'] = 1;
            } else {
                $arr['result'] = 0;
                $arr['message'] = "sql Err.";
            }
        } else {
            $arr['result'] = 0;
            $arr['message'] = "xapi is valid";
        }
    } else {
        $arr['result'] = 9;
        $arr['message'] = "Connection Error";
    }
    echo json_encode($arr);
    ?>