Member Avatar for PF2G
PF2G 0 Junior Poster in Training

Hi,

I'm using a javascript messagebox, but i'm having trouble with the delete:

<html>
        <head>
            <title>Adminstração</title>
            <!---------------------------------------------->
            <script type="text/JavaScript">
                function confirmDelete()
                {
                    var agree=confirm("Tem a certeza que quer remover?");

                    if (agree)
                    {
                         return true;
                         <?PHP
                            $del="DELETE FROM content_lang WHERE id_content = '".$row_lang['id_content']."'";
                            $q_del=mysql_query ($del, $connect);
                        ?>
                    }
                    else
                    {
                         return false;
                    }
                }
            </script>
            <!---------------------------------------------->
        </head>


        (....)

        <td width="5%">
                        <a href="" onClick="confirmDelete();">Remover</a>
                    </td>
                </tr>
            </table>

I feel stupid to not know where the error is :/

Can someone help me, please?

Thank you

  • 1 Contributor
  • 0 Replies
  • 97 Views

Dani AI

Generated

The problem is that PHP runs on the server while confirm() runs in the browser. Putting a PHP DELETE inside a JavaScript function does not wait for the user: the server code is evaluated when the page is built, not after the browser confirm. Move the DELETE into a separate server request and use the confirm dialog only to decide whether to send that request.

A few safe patterns:

  • Minimal client-side confirm that only navigates when the user accepts:

    <a href="delete.php?id=123" onclick="return confirm('Tem a certeza que quer remover?')">Remover</a>

  • Better: submit a POST (so deletion is not triggered by a GET) and include a CSRF token. Each row can have its own hidden form:

    <form id="del-123" method="post" action="delete.php">
  <input type="hidden" name="id_content" value="123">
  <input type="hidden" name="csrf_token" value="...">
</form>

<a href="#" onclick="if (confirm('Tem a certeza que quer remover?')) document.getElementById('del-123').submit(); return false;">Remover</a>

On the server, validate authorization and CSRF, cast the incoming id to an integer, and use prepared statements (PDO or MySQLi) instead of the old mysql_* functions. Example server-side pattern:

$id = (int) $_POST['id_content'];
// verify CSRF and user permission here
$stmt = $pdo->prepare('DELETE FROM content_lang WHERE id_content = :id');
$stmt->execute([':id' => $id]);

References: MDN on confirm() for client behavior (Window.confirm), OWASP on CSRF protections (CSRF prevention cheatsheet), and PHP PDO docs for prepared statements (PDO::prepare).

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.