Search code examples
phpsqlidentifier

secure button command processing in PHP


I have a database with orders, first entry would be:

id(int) = 1

info_1(varchar) = 'one'

info_2(varchar) = 'two'

I'm using a PHP scipt that itterates through orders and creates HTML buttons:

while ($temp = mysql_fetch_assoc($query3))
{
   echo "<button id=\"".$temp['id']."\" name=\"delete_but\">Delete</button>";
   // plus some conditions
}

Result:

<button id="1" name="delete_but">Delete</button>
<button id="2" name="delete_but">Delete</button>
<button id="3" name="delete_but">Delete</button>
...
<button id="10" name="add_but">Add</button>
<button id="11" name="add_but">Add</button>
<button id="12" name="add_but">Add</button>
...

How do I create a PHP script, which will be triggered on button click? I'd like to remove entry from Table where (id == "clicked_button_id").

Also, I'd like to know if it's secure to put Order's ID inside button's ID, because every user will be able to see the HTML of my page (along with all IDs).


Solution

  • jQuery:

    $('button[name=delete_but]').click(function() {
      $.ajax({
        url: 'deleteEntry.php?id=' + $(this).attr('id')
      }).done(function() {
        $(this).hide();
      });
    });
    

    deleteEntry.php:

    $entryId = $_GET['id'];
    
    // ...database work to remove the entry with that id...