Question

Is it unsecure to use $_GET to update/delete the data from MySQL table??

I can’t use $_POST since it required to use <form> tag

For example:

  <a href="status.php?approve='123'>Unapprove</a>
 <?php   
    if (isLoggedIn() && groupId() == 2) {
     if (isset($_GET['id']) && is_numeric($_GET['id']) {
      $query = $db->prepare("UPDATE table set unapprove='1' where id = :id");
      $query->bindParam(':id', $_GET['id'], PDO::PARAM_STR);
      $query->execute();
     }
    }
?>

Please provide example how would you secure from my example or better way.

Answer 1

While not subject to SQL injections, what you’re doing is not secure because subject to cross-site request forgery.

Consider the effect of being logged in into your site, and visiting another that has this image:

<img src="yoursite.com/admin/status.php?approve=123" />

Ideally, always use POST for non-idempotent requests.

And at any rate, you need to add a secret token which is both session- and link-specific:

href="status.php?approve=123&token=[random_stuff]"

As an aside, the '123' in the link should probably be 123.