Okay so I have an ajax request that leads to a file called inc/ajax/del_images.php which delete's the image a user selected to delete
Edit_post.php:
<form class="form-control" action="" autocomplete="off" method="post" enctype="multipart/form-data">
<img id="img" src="some url from database">
<button id="delete-img" data-id="W12kwd2">Delete img</button>
<img id="img" src="some url from database">
<button id="delete-img" data-id="T93pm3P">Delete img</button>
</form>
data-id is the id of the img in the database table
Also images and buttons and gen from php which i didnt include as it adds no value to post
Ajax on edit_post:
$("#delete-img").on('click', function() {
$.ajax({
url: 'inc/ajax/del_images.php',
type: "POST",
data: {
img_id: $(this).attr("data-id")
},
cache: false,
success: function(result){
console.log(result);
}
});
)};
Then in del_images.php:
session_start();
if(isset($_POST['img_id'])){
//image id
$iid = $_POST['img_id'];
//let's check if this image id is valid/in the database
require("conn_user.php");
$stmt = $conn->prepare("SELECT * FROM `images` WHERE `ID` = ?");
$stmt->bind_param("s", $iid);
$stmt->execute();
$stmt_results = $stmt->get_result(); // get result
$row_get = $stmt_results->fetch_assoc();
if($stmt_results->num_rows > 0){
//img with the id was found
//now check if the current user is the owner of post with post[ID] related to the image[ID]
$stmt = $conn->prepare("SELECT * FROM `posts` WHERE `ID` = ?");
$stmt->bind_param("s", $row_get['post_id']);
$stmt->execute();
$stmt_results = $stmt->get_result(); // get result
$row_get_post = $stmt_results->fetch_assoc();
if($stmt_results->num_rows > 0){
//post was found lets check $_SESSION with poster id(in DB)
if($_SESSION['uid'] == $row_get_post['poster_id']){
//this means the current user is the owner of post aswell as the image
//now delete the image cuz the user is the owner which means its safe
$stmt = $conn->prepare("DELETE FROM `images` WHERE ID = ?");
$stmt->bind_param("s", $iid);
$stmt->execute();
$delete_results = $stmt->store_results(); // get result
if($delete_results->affected_rows == 1){
//image was deleted return info so page
print_r('image deleted!');
}else{
print_r('image could not be deleted!');
}
}else{
//id didnt match prop a hacker so force kick and admin review
//code removed for this post
}
}else{ //post not found this will never happen but if it does just add error output }
}else{
//img not found please tell the user
//this code was removed for simplicity of the post
}
}
MY DATABASES :
images table
| ID | post_ID | url |
| :--------:| :--------:|:--------:|
| W12kwd2 | 1 | mNDNJD3324kmWD382n3r.png |
| T93pm3P | 1 | In3u2n329dnjJDEJKDde.jpg |
| Wo90dmp | 2 | JNMduwio3232ndsakdew.jpeg|
posts table
| ID | post_title | poster_id |
| :--------: | :--------: |:--------: |
| 1| What a title | 1 |
| 2| Can you code?| 1|
| 3| Ajax, why and how | 4 |
MY ISSUE :
The issue
So another user can't delete another users image cuz i am check that they are the owner of the post of which the image is related too but lets say the user is busy editing post 1 the edit post url will look like this edit_post?post_id=1 which is fine but the user can in the buttons data-id insert the id of images related to post ID 2 and delete them cuz he is the owner of post ID 2 aswell(you can see it from db example) now first i think lets just get the id from the url but any idiot who knows how frontend works will be able to check the js to just insert the value they want for the url id= so how can i limit this so that a user can only delete the images of the post that they are currently editing without having to work with a frontend supply id
i tough maybe to use a $_SESSION['current_edit'] = "current id of post which they clicked edit on" but the issue leads what is they have multi tabs cuz they editing more that one post I know i need to work with some type of supplied id but how can i lock it down so that users can't delete images of other posts they own while editing another post.
FOOTER NOTE* if I need to supply more info and edit the post to be more clear of more specific please tell me and i will do it as i know StackOverflow is a clean and well maintained site ~ Have a great day :)
