Deleting data in Symfony2

Question

I have delete options for each row like this. I successfully deleted the data using GET method but How to delete in POST/DELETE method using the same layout? Is GET method the safe way to delete?

Answer 1

To use the DELETE method the best way is to use a form with a POST method and then fake the DELETE using a _method field. The form can then set the CSS of the form to be display: inline; or display: inline-block;.

Your "delete button"

<form action="{{ path('your_path') }}" method="POST" class="delete-button-form>
    <input name="_method" value="DELETE" type="hidden">
    <button type="submit" class="btn btn-danger">Delete</button>
</form>

Your css

form.delete-button-form {
    display: inline-block;
}

You can see a fiddle of this layout here

You will also need to set the config to use the http method override which the docs cover better than I could. Taken from here

The _method functionality shown here is disabled by default in Symfony 2.2 and 
enabled by default in Symfony 2.3. To control it in Symfony 2.2, you must call 
Request::enableHttpMethodParameterOverride before you handle the request (e.g. 
in your front controller). In Symfony 2.3, use the http_method_override option.

Answer 2

Is GET method the safe way to delete?

I don't think is safer to use GET, POST, or DELETE. Whatever method you use, you still have to add rules in the firewall or in the controller to ensure that an user has the right to delete something.

You can declare a specific route for deleting an instance of your entity, without using any form:

/**
 * @Route(
 *      "/something/{id}/delete",
 *      name="something_delete"
 * )
 */
public function somethingRemoveAction($id)
{
    $something = $this->getDoctrine()
        ->getRepository('ACMEBundle:Something')
        ->find($id);

    $em = $this->getDoctrine()->getManager();
    $em->remove($something);
    $em->flush();

    // Suggestion: add a message in the flashbag

    // Redirect to the table page
    return $this->redirect($this->generateUrl('something_list'));
}

Then create a button for each row of the table:

<a href="{{ path('something_delete', {'id': something.id}) }}">
    <button type="button">Delete</button></a>