Member Avatar for klemme

I was adding a link to make it poosible to delete a page on a site, which is not yet published.

the link looks like this, with the processing below it:

<?php 
// The Link
echo '<a href=\"process_delete_page.php?pid=' . $id . '">Slet siden her!</a>'; 

// Processing the request
$id = $_GET['id'];

include_once "../includes/connection.php";

$query="SELECT pos, subjectid FROM pages WHERE id=$id";
$result = mysqli_query($myConnection, $query);
while($row=mysqli_fetch_array($result)){
$position = $row['pos'];
$subjectid = $row['subjectid'];			
}
// Add the updated info into the database table..................................
$queryAdjustPosition = mysqli_query($myConnection, "UPDATE pages SET pos = pos - 1 WHERE pos > $position AND subjectid = $subjectid");

$query = mysqli_query($myConnection, "DELETE FROM pages WHERE id='$id'") or die (mysqli_error($myConnection));

echo '<div align="center">Page has been deleted successfully. <br /><br />
<a href="admin.php">Click here to head back to admin home!</a></div>';
exit();
?>

I get this after clicking the link:

Forbidden

You don't have permission to access /"process_delete_page.php on this server.

And the title of the error page giving that message, is displaying:

403 Forbidden

How come this happens, and how can I change this?

Its just a request to the database about deleting a record, hmmm..

  • 1 Contributor
  • 1 Reply
  • 232 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by klemme

Dani AI

Generated

Likely cause and quick diagnosis
The 403 text showing a path that starts with a quote (for example: /"process_delete_page.php) almost always means the generated anchor had a stray quote or backslash inside the href attribute, so the browser requested a URL that included an extra quote character and Apache refused it. A second, separate bug in the original snippet was a mismatch between the query name in the link (pid) and the code reading $_GET['id'] — that would keep the script from getting the right id even after the href is fixed. Confirm the problem by viewing the page source or hovering the link: if the href begins with a quote or contains backslashes, fix the string assembly.

How to fix and safer alternatives
Make the generated HTML produce a clean href and keep parameter names consistent. Better still, use a POST form for destructive actions and add a confirmation. Example pattern (replace server-side handling with prepared queries):

<form method="post" action="process_delete_page.php" onsubmit="return confirm('Delete this page?');">
  <input type="hidden" name="id" value="123">
  <button type="submit">Delete</button>
</form>

When generating attributes from PHP, avoid building mixed-quoted strings by using printf/sprintf or casting the id to an integer before inserting it into HTML.

Security and final checks
Always sanitize/validate the id (e.g. (int)$id or prepared statements) to prevent SQL injection. If a correct href still yields 403, check Apache error logs, .htaccess rules and mod_security — those can block requests that look suspicious. Since later reported "Made it work", the most likely real fix was correcting the malformed href and the parameter name; the above steps will prevent recurrence and make deletes safer.

Member Avatar for klemme

Made it work.... :-)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.