Ifstatement used to make a functionality button appear?

Question

I am on my 2nd day(16th hour) of trying to get my delete button to do what I want with PHP. I have a site that is a social network that has user profiles. Users can leave comments on another users profile. I am trying to put a delete link in a designated area that only shows up if you are viewing your own profile and goes away when you are viewing someone elses profile. I am also not wanting to make a delete confirm page. I want the page to reload with the comment selected to delete gone, and be sent to my db marked as dead. This is what I have so far:

           <?php

           $query = "SELECT * FROM `ProfileComments` WHERE `ToUserID` = '".$prof->id."' ORDER BY `date` DESC, `time` DESC LIMIT 10";


           $request = mysql_query($query,$connection);


           while($result = mysql_fetch_array($request)) {





           $poster = new User($result['FromUserID']);

           echo "<div id='CommentProfile'>";
           echo "<div id='CommentPhotoProfile'>";
           echo "<a href='http://www.blah.org/Profile.php?id=".$poster-&gt;id."'&gt;";
           echo "<img src='" . $poster->img('mini') . "' border='0'/>";
           echo "</a>";
           echo "</div>";
           echo "<div id='ProfileCommentBody' class= 'round_10px'>";
           echo "<div id='CommentNameProfile'>";
           echo "<div class='ProfileCommentTail'>&nbsp;</div>";
           echo "<a href='http://www.blah.org/Profile.php?id=".$poster-&gt;id."'&gt;";
           echo $poster->first_name. " ". $poster->last_name. " <span style='font-weight:normal'>says...</span>";
           echo "</a>";
           echo "</div>";
           echo stripslashes(nl2br($result['commentProfileBody']));
           echo "<div id='CommentInfoProfile'>";
           echo date('M d, Y',strtotime($result['date']));
           echo " at " . date('g:i A',strtotime($result['time']));
           if ($poster->id == $prof->id)
           echo "<a href='http://www.blah.org/DeleteComment.php?id=".$prof-&gt;id."'&gt;";
           echo " delete";
           echo "</a>";
           echo "</div>";
           echo "</div>";
           echo "</div>";
           }

           ?>

do I need to make a seperate query underneath the one I already have that is for the composition of the comments? do I need to add on to that query? how do I make the delete button only appear when the user is looking at their own page? how do I make the page reload with the comment gone after I selected it deleted and mark it dead in the db?

thank you in advance

Answer 1

Be careful if all you do after authorization of the delete privilege is then hide or not hide a button.

If users figure out another way to invoke the delete action, that kind of authorization checking won't work. For example, if your implementation uses a "delete URL" that encodes the delete command, and your button merely POSTs to that URL, then when the button is hidden, a user could manually post the delete command.

Answer 2

Fill in your variables:

if ($current_user_id == $profile_user_id)
    echo '<a href="deletelink">delete</a>';

Answer 3

This is toatlly lame, code, but just a random thought since you are really giving us nothing to work with. Take it for what it is:

function getPageUserID()
{
    return $_GET['userID'];
}
if ($user->userID == getPageUserID())
{
 //show delete button
    echo '<button value="Delete">Delete</button>';
}