php安全和使用html链接标记要删除的mysql记录（GET）

Question

Just wondering if people think it is safe for a website to use a html link to allow users to mark their documents for deletion from their secure account page?

I have a website where users can create documents once they have registered and logged in to the website. To delete a document I include links on their account page for each document to be marked for deletion as follows :

http://www.examplewebsitename.com/delete_document.php?docid=5

The delete_document script makes sure the docid parameter is numeric, then checks using a session variable of their user id set when they logged in, wether this person actually created this document by looking up the user id of the creator of the document. If they where the creator, then it marks the document for deletion, otherwise if the current logged in person wasnt the creator then it doesnt mark the document for deletion and returns an error page.

Do you think this is a valid and safe way to mark documents for deletion, or should I be using a form and Post to do this more securely?

Answer 1

Generally I advice against using GET requests to manipulate data because that's not what GET is designed to do if you stick to the HTTP Spec. If you would go completely restful you should be using a DELETE request but in most cases i use a confirmation page with a form that performs a POST request to delete the record.

Read Why should you delete using an HTTP POST or DELETE, rather than GET? for the reasoning behind this. It's been asked before in some other contexts.