Re: Delete
| From: | Rabin Vincent | Date: | Mon, 05 Jun 2006 05:41:56 +0000 |
| Subject: | Re: Delete | ||
| References: | 1 2 3 4 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-237393@lists.php.net to get a copy of this message | ||
On 6/4/06, Larry Garfield <larry@garfieldtech.com> wrote:
Only if delete.php is a confirmation page. Never ever ever have a delete function that operates solely by GET. Here's why: http://thedailywtf.com/forums/thread/66166.aspxYes, I've seen that one before. IMO the main problem there is the faulty authentication system. If you put delete links public, and fail to put proper authentication in place, someone's going to delete your content, no matter if the delete action is a POST submit button or a GET link. I don't see how POST is better/more secure for a delete action. Rabin