Question

i have a function that calls javascript:del_release_comment(10,12); from the page, if the user has that particular comment.

I wonder if other users can trigger from the URL bar or somehow else this function to delete comments that aren’t their.

10 is the news_id and 12 is the comment_news_id, the id of the comment on that particular news.

THe delete is done via AJAX calling a PHP script that does delete on these 2 parameters.
If the javascript function can be called by hand i’d have to re-enforce the little PHP script that deletes the comment. Also, is it possible to call that particular PHP script by name in the URL directly ? It uses _POST vars, not GET.

Thanks.

code for deleting the comment :

$query_del_comment = "DELETE from myl_news_comments WHERE comment_id='".mysql_real_escape_string($_POST['comment_news_id'])."' AND news_id='".mysql_real_escape_string($_POST['news_id'])."'";
$result_del_comment = mysql_query($query_del_comment) or die('Query failed: ' . mysql_error());

Answer 1

Clients can execute any HTTP request they like using a variety of techniques (including calling your JavaScript functions, or building it manually).

You must perform authentication / authorisation on the server to ensure that the request to delete something is from someone authorised to delete that something.