473,831 Members | 2,282 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

Confirming deletion of records

3 New Member
I have been developing a website over the past couple for my wife who is an artist. During that time I have taught myself PHP and mySQL and developed a content management system that allows her to upload and edit pictures, and and delete information like links and exhibitions and generally stop hassling me.

I have now extended it cover a couple of her art groups where she can create and delete new artists and they then have the same control.

As t has been just a hobby and only for her security hasn't been my greatest concern. However now that others are using it I am a bit concerned about hackers.

So my question is: How can I intercept a delete artist command and send an email to the person who has administrative rights to confirm that they really want to continue with the deletion as it could mean deleting hundreds of pictures. I already have an "are you really sure" page for accidents.

Many thanks in advance,

Simon

PS Her site is here and the group site here
Nov 20 '09 #1
4 1808
Atli
5,058 Recognized Expert Expert
Hey Simon.

A simple way to do something like that is to just to generate a unique string, send it to the user via email, and ask them to copy/paste the string into a input box.

Simply put:
Expand|Select|Wrap|Line Numbers
  1. <?php
  2. session_start();
  3. $_SESSION['confirmation_key'] = md5(microtime(true) . mt_rand(1000));
  4.  
  5. $to      = 'user@example.com';
  6. $subject = 'Artist deletion confirmation.';
  7. $message = 'This is your key: ' . $_SESSION['confirmation_key'];
  8. $headers = 'From: no-reply@example.com' . "\r\n" .
  9.     'Reply-To: no-reply@example.com' . "\r\n" .
  10.     'X-Mailer: PHP/' . phpversion();
  11.  
  12. if(!mail($to, $subject, $message, $headers)) {
  13.     die('Failed to send the confirmation email. Please go whine about it to the webmaster.');
  14. }
  15. ?>
  16. <!DOCTYPE html>
  17. <html>
  18.     <head><title>Delete stuff</title></head>
  19.     <body>
  20.         <form action="deleteStuff.php" method="post">
  21.             The Key: <input type="text" name="the_key" />
  22.             <input type="submit" />
  23.         </form>
  24.     </body>
  25. </html>
Expand|Select|Wrap|Line Numbers
  1. <?php
  2. if(isset($_POST['the_key'])) {
  3.     if($_POST['the_key'] == $_SESSION['confirmation_key']) {
  4.         // Delete stuff
  5.     }
  6.     else {
  7.         echo "Better luck next time.";
  8.     }
  9. }
  10. ?>
That's at least the general idea.
Nov 22 '09 #2
simonf
3 New Member
Alti,

Many thanks for your response. The adminstrator already has to log in and I control access to the page that deletes all the pictures and the user and using the $_SESSION variable. I have written the code to delete the pictures and user and then got worried about hackers.

What I had in mind was that once the administrator had hit the delete key the PHP code would be suspended until a confirmation response is recieved and if it isn't within, say 24hours, it would cancel the delete.

On reflection and researching a bit further I think this is a bit fanciful and I'll rely on the login script and regular backups!

Once again, many thanks for your time and the code; which I will adapt for email confirming when a new user is created.
Nov 22 '09 #3
Atli
5,058 Recognized Expert Expert
Ok, no problem.

One good way to avoid getting hacked and having all your info deleted, is to not use delete statements. Rather than DELETE the user and all the data belonging to it, you could add a 'deleted' field to the user table and UPDATE it to read TRUE. Then you could just omit the users marked deleted from the data you display.

To further protect against this, you could restrict the database user to only be allowed to use the SELECT and INSERT commands on most tables, and UPDATE on only the tables that need it. That way, even if somebody managed to hack his way into a admin account, or get a hold of your database login, the worst he would be able to do is replace the data in the UPDATE'able tables and add more data to the others.
Nov 22 '09 #4
simonf
3 New Member
Alti, once again thanks for your time and some very good ideas. I'll implement the delete flag idea and then write something so I can purge the database regularly.

Reagrds,

Simon
Nov 23 '09 #5

Sign in to post your reply or Sign up for a free account.

Similar topics

5
6595
by: Tuhin Kumar | last post by:
Hi, I have a requirement on improving the deletion rate on on records of a table. The table contains 5 million records, but since deleting everything matching the condition at one go was giving the ROLLBACK segment allocation error, the query was called in a loop and deleting 2000 rows at one interation. My query is: DELETE FROM Table1 WHERE TimeStamp >= TO_DATE('2003-11-30 18:30:00', 'YYYY-MM-DD HH24:MI:SS') and TimeStamp <=...
2
2612
by: C Kirby | last post by:
I'm running a DB using MSDE (2000) that is interfaced by 2 different ades running on PCs with Access 2000 Runtime. One of the ADEs is a package accounting system that is very solid and stable, the other is a custom application that I wrote (much less solid and stable). The custom app only deals with a select few tables in the database, and the table in question is not one of those. With alarming regularity(daily), records are getting...
5
2525
by: Alex | last post by:
Hi, I have two tables , A and B where table B has a foreign key constraint to table A. I want to delete all records in table A that are older than a certain date that are not referenced by table B. When I use a DELETE FROM the entire transaction fails as soon as a referential integrity violation is detected.
5
29021
by: Grant | last post by:
Hi Is there a way to recover deleted records from a table. A mass deletion has occurred and Access has been closed since it happened Louis
4
1816
by: Lyle Fairfield | last post by:
This takes about 2 seconds on my rather obsolete machine: Option Explicit ' Test is a simple JET Table with four fields ' ID -> autonumber primary key ' Field1 -> Integer (maps to VBA long) ' Field2 -> Text (50) ' Field3 -> DateTime
3
3376
by: deekay | last post by:
I'm using Access 2000 working in DAO at the moment and am having trouble deleting a record from a form that has been filtered. So I'm filtering a form and then when the user selects the record and tries to delete it using that button on the toolbar (i haven't been using any manually coded method) that default delete confirmation message is not coming up even though the record is successfully being deleted from the database. Also any...
0
1717
by: dio_mack | last post by:
MINIMIZE RISK BY CONFIRMING IDENTITY OF INDIVIDUALS Obtain the confidence you need to move forward quickly and accurately in business, institutional and personal matters with a full-spectrum check- including legal name, date of birth, SSN search, current and last known addresses and phone numbers, plus other identity search including birth records and death records. IDENTIFY A PERSON'S LEGAL OR CRIMINAL HISTORY In matters of public record,...
2
3117
by: MRW | last post by:
Hello! I'm trying to execute a code so when a record in a DetailsView is deleted, it will first have to be confirmed (with as little code as possible). The DetailsView is attacked to an ObjectDataSource. I was thinking of having the ItemDeleting command 'intercept' the delete command and make a confirmation button visible on the screen, THEN when the person clicks the button the ObjectDataSource executes the delete command. My...
11
3691
by: shriil | last post by:
Hi I have this database that calculates and stores the incentive amount earned by employees of a particular department. Each record is entered by entering the Date, Shift (morn, eve, or night) and the 'employee name'. There is another table which assigns an ID to the Shifts, i.e. 1,2 and 3 for morn, eve & night shifts respectively. From the mother table, the incentive is calculated datewise for each employee as per his shift duty. In...
0
10777
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers, it seems that the internal comparison operator "<=>" tries to promote arguments from unsigned to signed. This is as boiled down as I can make it. Here is my compilation command: g++-12 -std=c++20 -Wnarrowing bit_field.cpp Here is the code in...
0
10493
jinu1996
by: jinu1996 | last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven tapestry of website design and digital marketing. It's not merely about having a website; it's about crafting an immersive digital experience that captivates audiences and drives business growth. The Art of Business Website Design Your website is...
1
10526
by: Hystou | last post by:
Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows Update option using the Control Panel or Settings app; it automatically checks for updates and installs any it finds, whether you like it or not. For most users, this new feature is actually very convenient. If you want to control the update process,...
0
10206
tracyyun
by: tracyyun | last post by:
Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each protocol has its own unique characteristics and advantages, but as a user who is planning to build a smart home system, I am a bit confused by the choice of these technologies. I'm particularly interested in Zigbee because I've heard it does some...
0
9315
agi2029
by: agi2029 | last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing, and deployment—without human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then launch it, all on its own.... Now, this would greatly impact the work of software developers. The idea...
1
7747
isladogs
by: isladogs | last post by:
The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome a new presenter, Adolph Dupré who will be discussing some powerful techniques for using class modules. He will explain when you may want to use classes instead of User Defined Types (UDT). For example, to manage the data in unbound forms. Adolph will...
0
5617
by: TSSRALBI | last post by:
Hello I'm a network technician in training and I need your help. I am currently learning how to create and manage the different types of VPNs and I have a question about LAN-to-LAN VPNs. The last exercise I practiced was to create a LAN-to-LAN VPN between two Pfsense firewalls, by using IPSEC protocols. I succeeded, with both firewalls in the same network. But I'm wondering if it's possible to do the same thing, with 2 Pfsense firewalls...
0
5780
by: adsilva | last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
2
3960
muto222
by: muto222 | last post by:
How can i add a mobile payment intergratation into php mysql website.

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.