I have been developing a website over the past couple for my wife who is an artist. During that time I have taught myself PHP and mySQL and developed a content management system that allows her to upload and edit pictures, and and delete information like links and exhibitions and generally stop hassling me.
I have now extended it cover a couple of her art groups where she can create and delete new artists and they then have the same control.
As t has been just a hobby and only for her security hasn't been my greatest concern. However now that others are using it I am a bit concerned about hackers.
So my question is: How can I intercept a delete artist command and send an email to the person who has administrative rights to confirm that they really want to continue with the deletion as it could mean deleting hundreds of pictures. I already have an "are you really sure" page for accidents.
Many thanks in advance,
Simon
PS Her site is here and the group site here 4 1808 Atli 5,058
Recognized Expert Expert
Hey Simon.
A simple way to do something like that is to just to generate a unique string, send it to the user via email, and ask them to copy/paste the string into a input box.
Simply put: - <?php
-
session_start();
-
$_SESSION['confirmation_key'] = md5(microtime(true) . mt_rand(1000));
-
-
$to = 'user@example.com';
-
$subject = 'Artist deletion confirmation.';
-
$message = 'This is your key: ' . $_SESSION['confirmation_key'];
-
$headers = 'From: no-reply@example.com' . "\r\n" .
-
'Reply-To: no-reply@example.com' . "\r\n" .
-
'X-Mailer: PHP/' . phpversion();
-
-
if(!mail($to, $subject, $message, $headers)) {
-
die('Failed to send the confirmation email. Please go whine about it to the webmaster.');
-
}
-
?>
-
<!DOCTYPE html>
-
<html>
-
<head><title>Delete stuff</title></head>
-
<body>
-
<form action="deleteStuff.php" method="post">
-
The Key: <input type="text" name="the_key" />
-
<input type="submit" />
-
</form>
-
</body>
-
</html>
- <?php
-
if(isset($_POST['the_key'])) {
-
if($_POST['the_key'] == $_SESSION['confirmation_key']) {
-
// Delete stuff
-
}
-
else {
-
echo "Better luck next time.";
-
}
-
}
-
?>
That's at least the general idea.
Alti,
Many thanks for your response. The adminstrator already has to log in and I control access to the page that deletes all the pictures and the user and using the $_SESSION variable. I have written the code to delete the pictures and user and then got worried about hackers.
What I had in mind was that once the administrator had hit the delete key the PHP code would be suspended until a confirmation response is recieved and if it isn't within, say 24hours, it would cancel the delete.
On reflection and researching a bit further I think this is a bit fanciful and I'll rely on the login script and regular backups!
Once again, many thanks for your time and the code; which I will adapt for email confirming when a new user is created.
Atli 5,058
Recognized Expert Expert
Ok, no problem.
One good way to avoid getting hacked and having all your info deleted, is to not use delete statements. Rather than DELETE the user and all the data belonging to it, you could add a 'deleted' field to the user table and UPDATE it to read TRUE. Then you could just omit the users marked deleted from the data you display.
To further protect against this, you could restrict the database user to only be allowed to use the SELECT and INSERT commands on most tables, and UPDATE on only the tables that need it. That way, even if somebody managed to hack his way into a admin account, or get a hold of your database login, the worst he would be able to do is replace the data in the UPDATE'able tables and add more data to the others.
Alti, once again thanks for your time and some very good ideas. I'll implement the delete flag idea and then write something so I can purge the database regularly.
Reagrds,
Simon
Sign in to post your reply or Sign up for a free account.
Similar topics |
by: Tuhin Kumar |
last post by:
Hi,
I have a requirement on improving the deletion rate on on records
of a table.
The table contains 5 million records, but since deleting everything
matching the condition at one go was giving the ROLLBACK segment
allocation error, the query was called in a loop and deleting 2000
rows at one interation.
My query is:
DELETE FROM Table1 WHERE TimeStamp >= TO_DATE('2003-11-30 18:30:00',
'YYYY-MM-DD HH24:MI:SS') and TimeStamp <=...
|
by: C Kirby |
last post by:
I'm running a DB using MSDE (2000) that is interfaced by 2 different
ades running on PCs with Access 2000 Runtime. One of the ADEs is a
package accounting system that is very solid and stable, the other is
a custom application that I wrote (much less solid and stable). The
custom app only deals with a select few tables in the database, and
the table in question is not one of those.
With alarming regularity(daily), records are getting...
|
by: Alex |
last post by:
Hi,
I have two tables , A and B where table B has a foreign key constraint
to table A.
I want to delete all records in table A that are older than a certain
date that are not referenced by table B.
When I use a DELETE FROM the entire transaction fails as soon as a
referential integrity violation is detected.
|
by: Grant |
last post by:
Hi
Is there a way to recover deleted records from a table. A mass deletion has
occurred and Access has been closed since it happened
Louis
|
by: Lyle Fairfield |
last post by:
This takes about 2 seconds on my rather obsolete machine:
Option Explicit
' Test is a simple JET Table with four fields
' ID -> autonumber primary key
' Field1 -> Integer (maps to VBA long)
' Field2 -> Text (50)
' Field3 -> DateTime
| |
by: deekay |
last post by:
I'm using Access 2000 working in DAO at the moment and am having
trouble deleting a record from a form that has been filtered.
So I'm filtering a form and then when the user selects the record and
tries to delete it using that button on the toolbar (i haven't been
using any manually coded method) that default delete confirmation
message is not coming up even though the record is successfully being
deleted from the database.
Also any...
|
by: dio_mack |
last post by:
MINIMIZE RISK BY CONFIRMING IDENTITY OF INDIVIDUALS
Obtain the confidence you need to move forward quickly and accurately in business, institutional and personal matters with a full-spectrum check- including legal name, date of birth, SSN search, current and last known addresses and phone numbers, plus other identity search including birth records and death records.
IDENTIFY A PERSON'S LEGAL OR CRIMINAL HISTORY
In matters of public record,...
|
by: MRW |
last post by:
Hello!
I'm trying to execute a code so when a record in a DetailsView is
deleted, it will first have to be confirmed (with as little code as
possible). The DetailsView is attacked to an ObjectDataSource. I was
thinking of having the ItemDeleting command 'intercept' the delete
command and make a confirmation button visible on the screen, THEN when
the person clicks the button the ObjectDataSource executes the delete
command. My...
|
by: shriil |
last post by:
Hi
I have this database that calculates and stores the incentive amount
earned by employees of a particular department. Each record is
entered
by entering the Date, Shift (morn, eve, or night) and the 'employee
name'. There is another table which assigns an ID to the Shifts, i.e.
1,2 and 3 for morn, eve & night shifts respectively. From the mother
table, the incentive is calculated datewise for each employee as per
his shift duty. In...
|
by: Oralloy |
last post by:
Hello folks,
I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>".
The problem is that using the GNU compilers, it seems that the internal comparison operator "<=>" tries to promote arguments from unsigned to signed.
This is as boiled down as I can make it.
Here is my compilation command:
g++-12 -std=c++20 -Wnarrowing bit_field.cpp
Here is the code in...
|
by: jinu1996 |
last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven tapestry of website design and digital marketing. It's not merely about having a website; it's about crafting an immersive digital experience that captivates audiences and drives business growth.
The Art of Business Website Design
Your website is...
| |
by: Hystou |
last post by:
Overview:
Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows Update option using the Control Panel or Settings app; it automatically checks for updates and installs any it finds, whether you like it or not. For most users, this new feature is actually very convenient. If you want to control the update process,...
|
by: tracyyun |
last post by:
Dear forum friends,
With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each protocol has its own unique characteristics and advantages, but as a user who is planning to build a smart home system, I am a bit confused by the choice of these technologies. I'm particularly interested in Zigbee because I've heard it does some...
|
by: agi2029 |
last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing, and deployment—without human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then launch it, all on its own....
Now, this would greatly impact the work of software developers. The idea...
|
by: isladogs |
last post by:
The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM).
In this session, we are pleased to welcome a new presenter, Adolph Dupré who will be discussing some powerful techniques for using class modules.
He will explain when you may want to use classes instead of User Defined Types (UDT). For example, to manage the data in unbound forms.
Adolph will...
|
by: TSSRALBI |
last post by:
Hello
I'm a network technician in training and I need your help.
I am currently learning how to create and manage the different types of VPNs and I have a question about LAN-to-LAN VPNs.
The last exercise I practiced was to create a LAN-to-LAN VPN between two Pfsense firewalls, by using IPSEC protocols.
I succeeded, with both firewalls in the same network. But I'm wondering if it's possible to do the same thing, with 2 Pfsense firewalls...
|
by: adsilva |
last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
| |
by: muto222 |
last post by:
How can i add a mobile payment intergratation into php mysql website.
| |