Do something based on user input

Question

I have something like this

  $result = $conn->query("DELETE FROM agendas WHERE agendaID='" . $_GET["delete"] . "'");

Where $_GET["delete"] is the id that I just received with GET.

I want to ask the user if he wants to delete or not, but not sure how to implement getting his input.

I was thinking about using 2 links, but not sure how to pass the answer, since then they can do whatever they want.

echo '<a href="url">Yes</a>';
echo '<a href="url">No</a>';

You mean get confirmation from the user like `Are you sure to delete?` in popup box. — Ranjith, Jun 09 '14 at 09:32
No, just a link that when pressed asks. Then, if they press yes it executes the query, else it goes back to wherever it was. — George Irimiciuc, Jun 09 '14 at 09:33
**Danger**: You are **vulnerable to [SQL injection attacks](http://bobby-tables.com/)** that you need to [defend](http://stackoverflow.com/questions/60174/best-way-to-prevent-sql-injection-in-php) yourself from. — Quentin, Jun 09 '14 at 09:33

score 0 · Accepted Answer · answered Jun 09 '14 at 09:33

Instead of sending a delete query to the database, generate an HTML form and send it to the browser.

If the user clicks the "Yes" submit button, then construct that query and run it.

(You'll need to pass through all the identifying data you need in hidden inputs).

score 0 · Answer 2 · edited May 23 '17 at 11:51

0

you can ask conformation like below:

<form onSubmit="return confirm('Are you sure you want to delete?')">
<button type="submit" ...>
</form>

REFER: Delete button and confirmation

edited May 23 '17 at 11:51

Community

1
1

answered Jun 09 '14 at 09:34

Mani

888
6
19

score 0 · Answer 3 · answered Jun 09 '14 at 09:39

Suppose it's a link the user is clicking on to delete, like so:

<a href="/delete.php?id=43">Delete</a>

The easiest way would be to use the Javascript confirm() method:

<a href="/delete.php?id=43" onclick="return confirm('Are you sure you wish to delete?')">Delete</a>

Another way would be to create a new document which the delete link points to. In this document you output a delete confirmation question to the user and the option to proceed to the actual script that deletes, or a cancel link which takes the user back to where he came from.

EDIT: Beware of SQL-injection attacks which your code is vulnerable to. See Quentin's comment above.

Do something based on user input

3 Answers3