Confirming deletion of records

I have been developing a website over the past couple for my wife who is an artist. During that time I have taught myself PHP and mySQL and developed a content management system that allows her to upload and edit pictures, and and delete information like links and exhibitions and generally stop hassling me.

I have now extended it cover a couple of her art groups where she can create and delete new artists and they then have the same control.

As t has been just a hobby and only for her security hasn't been my greatest concern. However now that others are using it I am a bit concerned about hackers.

So my question is: How can I intercept a delete artist command and send an email to the person who has administrative rights to confirm that they really want to continue with the deletion as it could mean deleting hundreds of pictures. I already have an "are you really sure" page for accidents.

Many thanks in advance,

Simon

PS Her site is here and the group site here

Nov 20 '09 #1

Subscribe Post Reply

1785

Atli

5,058

Expert 4TB

Hey Simon.

A simple way to do something like that is to just to generate a unique string, send it to the user via email, and ask them to copy/paste the string into a input box.

Simply put:

Expand|Select|Wrap|Line Numbers

 <?php

session_start();

$_SESSION['confirmation_key'] = md5(microtime(true) . mt_rand(1000));
 
$to      = 'user@example.com';

$subject = 'Artist deletion confirmation.';

$message = 'This is your key: ' . $_SESSION['confirmation_key'];

$headers = 'From: no-reply@example.com' . "\r\n" .

    'Reply-To: no-reply@example.com' . "\r\n" .

    'X-Mailer: PHP/' . phpversion();
 
if(!mail($to, $subject, $message, $headers)) {

    die('Failed to send the confirmation email. Please go whine about it to the webmaster.');

}

?>

<!DOCTYPE html>

<html>

    <head><title>Delete stuff</title></head>

    <body>

        <form action="deleteStuff.php" method="post">

            The Key: <input type="text" name="the_key" />

            <input type="submit" />

        </form>

    </body>

</html>

Expand|Select|Wrap|Line Numbers

 <?php

if(isset($_POST['the_key'])) {

    if($_POST['the_key'] == $_SESSION['confirmation_key']) {

        // Delete stuff

    }

    else {

        echo "Better luck next time.";

    }

}

?>

That's at least the general idea.

Nov 22 '09 #2

simonf

Alti,

Many thanks for your response. The adminstrator already has to log in and I control access to the page that deletes all the pictures and the user and using the $_SESSION variable. I have written the code to delete the pictures and user and then got worried about hackers.

What I had in mind was that once the administrator had hit the delete key the PHP code would be suspended until a confirmation response is recieved and if it isn't within, say 24hours, it would cancel the delete.

On reflection and researching a bit further I think this is a bit fanciful and I'll rely on the login script and regular backups!

Once again, many thanks for your time and the code; which I will adapt for email confirming when a new user is created.

Nov 22 '09 #3

Atli

5,058

Expert 4TB

Ok, no problem.

One good way to avoid getting hacked and having all your info deleted, is to not use delete statements. Rather than DELETE the user and all the data belonging to it, you could add a 'deleted' field to the user table and UPDATE it to read TRUE. Then you could just omit the users marked deleted from the data you display.

To further protect against this, you could restrict the database user to only be allowed to use the SELECT and INSERT commands on most tables, and UPDATE on only the tables that need it. That way, even if somebody managed to hack his way into a admin account, or get a hold of your database login, the worst he would be able to do is replace the data in the UPDATE'able tables and add more data to the others.

Nov 22 '09 #4

simonf

Alti, once again thanks for your time and some very good ideas. I'll implement the delete flag idea and then write something so I can purge the database regularly.

Reagrds,

Simon

Nov 23 '09 #5

Similar topics

How to improve the deletion rate.

by: Tuhin Kumar | last post by:

Hi, I have a requirement on improving the deletion rate on on records of a table. The table contains 5 million records, but since deleting everything matching the condition at one go was giving...

Oracle Database

Records getting deleted mysteriously..

by: C Kirby | last post by:

I'm running a DB using MSDE (2000) that is interfaced by 2 different ades running on PCs with Access 2000 Runtime. One of the ADEs is a package accounting system that is very solid and stable, the...

Microsoft SQL Server

Problem Deleting Referenced records

by: Alex | last post by:

Hi, I have two tables , A and B where table B has a foreign key constraint to table A. I want to delete all records in table A that are older than a certain date that are not referenced by...

PostgreSQL Database

recover deleted records

by: Grant | last post by:

Hi Is there a way to recover deleted records from a table. A mass deletion has occurred and Access has been closed since it happened Louis

Microsoft Access / VBA

How fast can we add 1000 or other number of records?

by: Lyle Fairfield | last post by:

This takes about 2 seconds on my rather obsolete machine: Option Explicit ' Test is a simple JET Table with four fields ' ID -> autonumber primary key ' Field1 -> Integer (maps to VBA long)...

Microsoft Access / VBA

Deleting filtered records not working properly.

by: deekay | last post by:

I'm using Access 2000 working in DAO at the moment and am having trouble deleting a record from a form that has been filtered. So I'm filtering a form and then when the user selects the record...

Microsoft Access / VBA

Investigate anyone, search records, Backgroundcheck-explorer

by: dio_mack | last post by:

MINIMIZE RISK BY CONFIRMING IDENTITY OF INDIVIDUALS Obtain the confidence you need to move forward quickly and accurately in business, institutional and personal matters with a full-spectrum check-...

ASP / Active Server Pages

Confirming a Deletion

by: MRW | last post by:

Hello! I'm trying to execute a code so when a record in a DetailsView is deleted, it will first have to be confirmed (with as little code as possible). The DetailsView is attacked to an...

ASP.NET

Deleting selected records from multiple tables at one go

by: shriil | last post by:

Hi I have this database that calculates and stores the incentive amount earned by employees of a particular department. Each record is entered by entering the Date, Shift (morn, eve, or night)...

Microsoft Access / VBA

Cloud Servers without Credit Card and Email Registration: A Simpler Way to Get on the Cloud

by: CloudSolutions | last post by:

Introduction: For many beginners and individual users, requiring a credit card and email registration may pose a barrier when starting to use cloud servers. However, some cloud server providers now...

General

Access Europe: Command bars, the Access Shortcut Tool and a simple Audit Log - Wed 3 April

by: isladogs | last post by:

The next Access Europe User Group meeting will be on Wednesday 3 Apr 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome former...

General

How to turn on java script in a villaon keypad mobile phone

by: Charles Arthur | last post by:

How do i turn on java script on a villaon, callus and itel keypad mobile phone

Java

Merging data from multiple Excel files

by: ryjfgjl | last post by:

In our work, we often receive Excel tables with data in the same format. If we want to analyze these data, it can be difficult to analyze them because the data is spread across multiple Excel files...

Data Management

Migrating Website to Cloud - Emmanuel Katto

by: emmanuelkatto | last post by:

Hi All, I am Emmanuel katto from Uganda. I want to ask what challenges you've faced while migrating a website to cloud. Please let me know. Thanks! Emmanuel

General

Navigating the Data Structures and Algorithms (DSA)

by: BarryA | last post by:

What are the essential steps and strategies outlined in the Data Structures and Algorithms (DSA) roadmap for aspiring data scientists? How can individuals effectively utilize this roadmap to progress...

Algorithms / Advanced Math

Looking to do Android software development, any suggestions? Is flutter better?

by: nemocccc | last post by:

hello, everyone, I want to develop a software for my android phone for daily needs, any suggestions?

General

Is that possible of reading the .csv file in column wise and the column have different lengths ?

by: Sonnysonu | last post by:

This is the data of csv file 1 2 3 1 2 3 1 2 3 1 2 3 2 3 2 3 3 the lengths should be different i have to store the data by column-wise with in the specific length. suppose the i have to...

C / C++

How to build RAID in BIOS?

by: Hystou | last post by:

There are some requirements for setting up RAID: 1. The motherboard and BIOS support RAID configuration. 2. The motherboard has 2 or more available SATA protocol SSD/HDD slots (including MSATA, M.2...

Computer Hardware