Confirming deletion of records

simonf

I have been developing a website over the past couple for my wife who is an artist. During that time I have taught myself PHP and mySQL and developed a content management system that allows her to upload and edit pictures, and and delete information like links and exhibitions and generally stop hassling me.

I have now extended it cover a couple of her art groups where she can create and delete new artists and they then have the same control.

As t has been just a hobby and only for her security hasn't been my greatest concern. However now that others are using it I am a bit concerned about hackers.

So my question is: How can I intercept a delete artist command and send an email to the person who has administrative rights to confirm that they really want to continue with the deletion as it could mean deleting hundreds of pictures. I already have an "are you really sure" page for accidents.

Many thanks in advance,

Simon

PS Her site is here and the group site here

Atli

Hey Simon.

A simple way to do something like that is to just to generate a unique string, send it to the user via email, and ask them to copy/paste the string into a input box.

Simply put:

Expand|Select|Wrap|Line Numbers

 <?php

session_start();

$_SESSION['confirmation_key'] = md5(microtime(true) . mt_rand(1000));
 
$to      = 'user@example.com';

$subject = 'Artist deletion confirmation.';

$message = 'This is your key: ' . $_SESSION['confirmation_key'];

$headers = 'From: no-reply@example.com' . "\r\n" .

    'Reply-To: no-reply@example.com' . "\r\n" .

    'X-Mailer: PHP/' . phpversion();
 
if(!mail($to, $subject, $message, $headers)) {

    die('Failed to send the confirmation email. Please go whine about it to the webmaster.');

}

?>

<!DOCTYPE html>

<html>

    <head><title>Delete stuff</title></head>

    <body>

        <form action="deleteStuff.php" method="post">

            The Key: <input type="text" name="the_key" />

            <input type="submit" />

        </form>

    </body>

</html>

Expand|Select|Wrap|Line Numbers

 <?php

if(isset($_POST['the_key'])) {

    if($_POST['the_key'] == $_SESSION['confirmation_key']) {

        // Delete stuff

    }

    else {

        echo "Better luck next time.";

    }

}

?>

That's at least the general idea.

simonf

Alti,

Many thanks for your response. The adminstrator already has to log in and I control access to the page that deletes all the pictures and the user and using the $_SESSION variable. I have written the code to delete the pictures and user and then got worried about hackers.

What I had in mind was that once the administrator had hit the delete key the PHP code would be suspended until a confirmation response is recieved and if it isn't within, say 24hours, it would cancel the delete.

On reflection and researching a bit further I think this is a bit fanciful and I'll rely on the login script and regular backups!

Once again, many thanks for your time and the code; which I will adapt for email confirming when a new user is created.

Atli

Ok, no problem.

One good way to avoid getting hacked and having all your info deleted, is to not use delete statements. Rather than DELETE the user and all the data belonging to it, you could add a 'deleted' field to the user table and UPDATE it to read TRUE. Then you could just omit the users marked deleted from the data you display.

To further protect against this, you could restrict the database user to only be allowed to use the SELECT and INSERT commands on most tables, and UPDATE on only the tables that need it. That way, even if somebody managed to hack his way into a admin account, or get a hold of your database login, the worst he would be able to do is replace the data in the UPDATE'able tables and add more data to the others.

simonf

Alti, once again thanks for your time and some very good ideas. I'll implement the delete flag idea and then write something so I can purge the database regularly.

Reagrds,

Simon

Confirming deletion of records

re: Confirming deletion of records

re: Confirming deletion of records

re: Confirming deletion of records

re: Confirming deletion of records

Similar PHP bytes

/bytes/development

/bytes/it

/bytes/about