Your logic is slightly off. The second || should be &&:
if ((!isset($action)) || ($action != "add" && $action != "delete"))
You can see why your original line fails by trying out a sample value. Let's say $action is "delete". Here's how the condition reduces down step by step:
// $action == "delete"
if ((!isset($action)) || ($action != "add" || $action != "delete"))
if ((!true) || ($action != "add" || $action != "delete"))
if (false || ($action != "add" || $action != "delete"))
if ($action != "add" || $action != "delete")
if (true || $action != "delete")
if (true || false)
if (true)
Oops! The condition just succeeded and printed "error", but it was supposed to fail. In fact, if you think about it, no matter what the value of $action is, one of the two != tests will return true. Switch the || to && and then the second to last line becomes if (true && false), which properly reduces to if (false).
There is a way to use || and have the test work, by the way. You have to negate everything else using De Morgan's law, i.e.:
if ((!isset($action)) || !($action == "add" || $action == "delete"))
You can read that in English as "if action is not (either add or remove), then".
"?a=xxx"part of the url$actionshould be null. I think if I was setting$actionto a static variable you would be right. Yet, because the user enters data there is a chance for problems. Correct me if I'm wrong.error_reporting(E_ALL);<- just add this line to your config file/top of script and see what really happens in your code :)