Question

I have a Questions table, primary key of this table is “id” with auto increment.
Now i am creating a control panel for manage questions. one of the capability in control panel is delete questions.
Now my question: i want send primary key of Questions table to client as identifier of a HTML tag so that when user click on the HTML tag for delete the question, primary key of question send to server for delete question. Is it a dangerous in terms of security? Do you have a better solution?

Answer 1

If your question is related to using the primary key versus any other set of unique columns to identify the record to delete, there is no difference in the security at the database level.

For example if you have a table with the following columns:

id - primary key
subject -
serial_number -
...
other fields

Where subject + serial_number or unique for each row, it makes no difference in terms of security whether you do

delete from table where id = '&id'

versus

delete from table where serial_number = '&1' and subject = '&2'

A delete using the primary key might well be faster.

However since this delete is being triggered from an html page, you will definitely need to look at how to secure the page and prevent accidental deletions, but that has no bearing on the decision to use the primary key versus any other field to delete the record.