secure way to delete records with php

Question

I have the following code snippet to delete records from a database given a primary key. This is called via an AJAY request, through GET. Anyone who were to examine my javascript could work out the URL and delete arbitrary records. What can I do to prevent this?

Not use GET?

Use sessions?

if($cmd=="deleterec") {
    $deleteQuery = "DELETE FROM AUCTIONS1 WHERE ARTICLE_NO = ?";
    if ($delRecord = $con->prepare($deleteQuery)) {
     $delRecord->bind_param("s", $pk);
     $delRecord->execute();
     $delRecord->close();
     echo "true";
    } else {
     echo "false";
    }
}

Answer 1

Don't expose CRUD methods via Ajax.

Answer 2

You can give your records a non-sequential random unique id to use in AJAX requests.

Still not the most secure solution although should be easy to integrate into your current system.

Answer 3

1. Use post rather than get
2. Embed hidden unique ids in any forms that will perform this action, and check that the id that comes back has been issued by you
3. Obfuscate the URL/parameter names
4. Generate unique IDs for the rows, and dont expose them externally, so an attacker cannot pick a row to delete.

Answer 4

Well, if not everyone can delete a record, make sure this one is behind a password, so only the authorized users can do deletes. Make yourself a login that adds a 'Delete' button on the page afterwards and on the PHP side make sure the user is authorized when processing the commands.

Oh and yes, make sure you always pass a confirmation value through POST to validate, not just a GET parameter, it's best practice, even with authorized users.

Answer 5

Not using GET won't change a thing. You have to use sessions to manage 'access control' before you even get to this point in the code.

That is to say, when the AJAX request is made you should at that point confirm via the session that the person making the request is allowed to do the delete, before actually doing it.

Think about how you would check permissions in a 'non-AJAX' way and do the same here.

Answer 6

There are two important aspect to your question.

Are authorized user supposed to be able to delete any record they see fit? If that's the case your issue is one of making sure the request came from an authorized user. In that case using PHP's session is one way of making sure that it's the user you authenticated that made the request. Of course, with all technologies you have to make sure you use PHP session the right way. There are a bunch of articles on that mather. PHPsec.org has one here.

If a user cannot delete any row, in addition to doing authentication and sessions you'll also need to had a check in your code for the verify if the record being deleted can be deleted by that user. Now this is highly dependant on your application. For example, in a project management software, one could be allowed to delete tasks associated with one project but not with another one. That's part of your business logic.

The best would be to perform both check. One, your application must verify if the user making the deletion is a valid user and is allowed to delete (very simple to implement with php sessions) and two make sure that the user can delete the specific record based on some form of ownership.