使用按钮运行MySQL删除查询

Question

I have a user account page which runs the following loop of code:

<?php foreach ( $cv_specs as $cv_spec ) : ?>
<div id="document_summary_container">
    <div id="document_text_container">
        <div id="document_id">ID: MFI<?php echo $cv_spec->id; ?></div>
        <div id="document_title"><?php echo $cv_spec->file_mask; ?></div>
        <div id="document_version">V1.<?php echo $doc_row['version_of']; ?></div>
        <div id="document_specifics_container"><?php if ($doc_row['load_date']) echo "Document Submitted&nbsp;".$doc_row['load_date']."<br />";?><?php if ($doc_row['review_complete_date']) echo "Document Reviewed&nbsp;".$doc_row['review_complete_date']."<br />";?><?php if (($doc_row['review_complete_date']) !== "") echo "Document seen by&nbsp;".$doc_row['num_reviews']."&nbsp;expert";?><?php if (($doc_row['num_reviews']) != 1) echo "s";?> 
        </div>
    </div>
    <div id="document_image_container">
    <img src="images/system/a4_logo.jpg" width="134" height="190" /></div>
    <div id="document_buttons_container"></div>
</div><!--document_summary_container-->
<?php endforeach?>

In effect this generates a summary of files that the logged in user has uploaded which are reviewed by other users of the site.

I want to add a button for each document listing which when clicked would run a number of queries to delete all the information relevant to that document from the database. Without wanting to sound vague, I'm really not sure of the best way to go about it. I thought about using $_GET actions on the button to invoke a stored procedure based on the parameters submitted but thought this would leave it massively open to user manipulation. Any thoughts appreciated.

Answer 1

Generally you should use a post request for this so people can't trick you into clicking on links that will send a delete request.

Make a button using just about any HTML element then, using jquery, put a .click event on it that sends the delete request through the POST method.

<span id='delete' style='color:blue;cursor:pointer;'>delete</span>
<script>
$("#delete").click(function(){
    $.post('/delete_path',{delete_id:1},function(){
        alert('deleted!');
    },'text');
}};
</script>