Member Avatar for php.coder

Hi;
how can i show the delete and edit link to the user who has posted the comment just like in facebook only the person who has posted the comment is allowed to edit or delete the comment below is my code

    <?php
//including the database connection file
include_once("includes/settings.php");
connect();

//fetching data in descending order (lastest entry first)
$result=mysql_query("SELECT * FROM comments ORDER BY id DESC");

echo "<table width='80%' border=0>";

echo "<tr bgcolor='#CCCCCC'>";
echo "<td>Name</td>";
echo "<td>Comments</td>";;
echo "</tr>";

while($res=mysql_fetch_array($result)){

    echo "<tr>";
    echo "<td>".$res['Name']."</td>";
    echo "<td>".$res['Comments']."</td>"; 
    echo "<td><a href=\"edit_comment.php?id=$res[id]\">Edit</a> | <a href=\"includes/delete.php?id=$res[id]\">Delete</a></td>";

}
echo "</table>";
?>
  • 3 Contributors
  • 3 Replies
  • 343 Views
  • 17 Hours Discussion Span
  • Latest Post Latest Post by klemme

Dani AI

Generated

Short answer: record the comment's author (store a numeric author_id in the comments table), compare that author_id to the logged-in user's id from the session when rendering links, and enforce the same check on the edit/delete endpoints. UI-only checks are insufficient — the server must deny unauthorized edits/deletes.

Example display logic (assumes session_start(), a PDO $pdo connection and a session user_id and csrf_token):

<?php
$stmt = $pdo->query('SELECT id, author_id, name, content FROM comments ORDER BY id DESC');
while ($c = $stmt->fetch(PDO::FETCH_ASSOC)) {
    $name = htmlspecialchars($c['name'], ENT_QUOTES, 'UTF-8');
    $body = nl2br(htmlspecialchars($c['content'], ENT_QUOTES, 'UTF-8'));
    echo "<div class='comment'><strong>{$name}</strong>: {$body}";

    if (!empty($_SESSION['user_id']) && (int)$_SESSION['user_id'] === (int)$c['author_id']) {
        echo " <a href='edit_comment.php?id={$c['id']}'>Edit</a>";
        echo "<form method='post' action='delete.php' style='display:inline'>
                <input type='hidden' name='id' value='{$c['id']}'>
                <input type='hidden' name='csrf' value='{$_SESSION['csrf_token']}'>
                <button type='submit'>Delete</button>
              </form>";
    }
    echo "</div>";
}
?>

Server-side enforcement (delete example):

<?php
session_start();
if (empty($_SESSION['user_id']) || empty($_POST['id']) || ($_POST['csrf'] ?? '') !== ($_SESSION['csrf_token'] ?? '')) {
    http_response_code(403);
    exit;
}
$del = $pdo->prepare('DELETE FROM comments WHERE id = ? AND author_id = ?');
$del->execute([ $_POST['id'], $_SESSION['user_id'] ]);
if ($del->rowCount()) { /* success */ } else { http_response_code(403); }
?>

Notes and cautions:

  • As suggested, track the comment author; prefer a numeric user_id (foreign key) over email.
  • Never rely on client-side hiding alone; always verify ownership on edit/delete endpoints.
  • Use prepared statements (PDO or mysqli), escape output (htmlspecialchars) to prevent XSS, prefer POST for destructive actions and include CSRF protection.
  • If converting an old schema, add author_id and backfill from users; consider soft-deletes and logging.
  • 's plugin suggestion is optional — not needed to implement per-user link visibility.

Recommended Answers

All 3 Replies

Member Avatar for Member #949455

how can i show the delete and edit link to the user who has posted the comment just like in facebook only the person who has posted the comment is allowed to edit or delete the comment below is my code

You can do that for any CMS or framework not just Facebook. The code you provided is inconclusive. It involve more code than just a query. I think you didn't know or not sure but this is from the admin section another words that person has to be register member and can do that. This is a little more work than you expected.

If you want that featuere then used this:

http://developers.facebook.com/docs/reference/plugins/comments/

If that's not what you need or want then my suggestion find another alternative. Your option is very limited.

Member Avatar for php.coder

the user is registered and also using sessions

Member Avatar for klemme

You could store the users email address along with the post. Then tjeck if logged in user has the same email address, as the author of the post which is currently being viewed - If so: echo edit/delete link..

Get the point?

EDIT: I understood your question as if you wanted similar functionality LIKE on Facebook, not that it was ON Facebook..

Anyways, hope it helps you!

Edited by klemme
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.