Home/ Questions/Q 727183
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-14T06:32:18+00:00

Sort of a methods/best practices question here that I am sure has been addressed,

  • 0

Sort of a methods/best practices question here that I am sure has been addressed, yet I can’t find a solution based on the vague search terms I enter.

I know starting off the question with “Fast and easy” will probably draw out a few sighs, so my apologies.

Here is the deal.

I have a logged in area where an ADMIN can do a whole host of POST operations to input data relating to their profile. The way I have data structured is pretty distinct and well segmented in most tables as it relates to the ID of the admin.

Now, I have a table where I dump one type of data into and differentiate this data by assigning the ADMIN’s unique ID to each record. In other words, all ADMINs have this one type of data writing to this table. I just differentiate by the ADMIN ID with each record.

I was planning on letting the ADMIN remove these records by clicking on a link with a query string – obviously using GET. Obviously, the query structure is in the link so any logged in admin could then exploit the URL and delete a competitor’s records.

Is the only way to safely do this through POST or should I pass through the session info that includes password and validate it against the ADMIN ID that is requesting the delete?

This is obviously much more work for me.

As they said in the auto repair biz I used to work in… there are 3 ways to do a job: Fast, Good, and Cheap. You can only have two at a time. Fast and cheap will not be good. Good and cheap will not have fast turnaround. Fast and good will NOT be cheap. haha

I guess that applies here… can never have Fast, Easy and Secure all at once 😉

Thanks in advance…

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    As a general rule, any operation that alters state (whether its session state, or database state) should use POST. That means the only ‘safe’ SQL operation you can perform with GET is SELECT. Even if you’re only using a back-end admin thing, you shouldn’t use get. Imagine re-opening your browser and finding that the last time you closed firefox was on your ‘DELETE EVERYTHING’ GET->delete page resulting in everything being deleted again.

    One of the main reasons for this is preventing cross-site request forgeries. For example, if you had a page that took a GET variable such as http://example.com/account?action=logout, an attacker could post an image on your site like this:

    <img src="http://example.com/account?action=logout" />

    and anyone who opened a page containing that image tag would be immediately logged out, even if they were an admin. It would be very annoying to then search through your raw database for that data and remove it.

    Although POST operations are ‘nearly’ as easy to forge, as a general rule with any web security issue, the trade-off is speed/simplicity vs. security, so you’re going to have to choose one or the other.

    • 0