weixin_33733810 2016-06-19 13:47 采纳率: 0%
浏览 16

PHP-Mysql-安全

I have written following PHP and Javascript code to prompt a user to delete a record, which works great.

I somehow do not think that this code is secure, the reason is if you run the script in a browser, and do a View-source a person will be able to see that I am using delete.php and passing an ID to delete the record.So there can be a possibility of deleting the records using delete.php

Is there a way to secure the code.

My PHP code is

<?
        $rs = "SELECT * FROM my tablename";

                    $result = mysqli_query($con,$rs);           
                    $data = mysqli_num_rows($result);

                    $responses = array();
                    if($data != 0) {

                          while($results = mysqli_fetch_assoc($result))
                          {
                          $res_id=$results['id'];
                            echo "<tr id='".$results['id']."'><td>".$results['_name'] ."</td>";         

                            echo "<td><a alt='delete'  href='javascript:;' onclick='fun_delete(".$results['id'].")' title='delete'><span class='glyphicon glyphicon-remove-circle'></span> ";
                            e
                          }
                    } 

        ?>

My Javascript code is

<script>
function fun_delete(x)
 {

 //alert(x);
  var result = confirm("Are you sure you want to delete the record?");
  if (result) {
    //alert(x);
        jQuery.ajax({
            url: "delete.php",
            type: "post",
            data: {id:x},
            success: function(data){

                if(data){

                   location.reload(); 
                }
            },
            error:function(){
                // JQ.fancybox.hideLoading();
                alert("failure");
            }
        });
}
}

 </script>  
  • 写回答

0条回答 默认 最新

    报告相同问题?