Codeigniter securely delete db entries

Question

What is the safest way to delete rows in a database table using Codeigniter?

I am using the following method.

HTML: Retrieves links submitted by user (link title, url, and description). Adds Remove link to each entry. The link has a third segment that is the entry id from the db, link_id.

<ul id="user_links">
    <?php foreach($query as $row): ?>

    <li><?php echo $row->link_title; ?></li>
    <li><?php echo auto_link($row->link_url, 'url', TRUE); ?></li>
    <li><?php echo $row->link_description; ?></li>
    <?php echo anchor('profile/remove_link/'.$row->link_id, 'Remove', 'title="Remove link"'); ?>

    <?php endforeach; ?>
</ul>

CONTROLLER:

    function remove_link()
    {
               $link_id = $this->uri->segment(3);
               $seg = 'user_links'; //used in model for redirecting back to page
               $this->load->model('Link_model');
               $this->Profile_model->link_delete($link_id, $seg);
    }

MODEL:

function link_delete($link_id, $seg)
{
    $this->db->where('user_id', $this->tank_auth->get_user_id());
    $this->db->where('link_id', $link_id);
    $this->db->delete('user_links'); 
    redirect("/profile/$seg/");         
}

This works but I'm concerned that deleting entries via an URI segment is unsafe. Is my code safe? Otherwise what do you recommend?

I asked a similar question a while ago: http://stackoverflow.com/questions/5930870/removing-content-from-database-security-precautions Perhaps it helps you out. — Joris Ooms, Jun 05 '11 at 16:59
Hi @cabaret. Thx for the link. I did not know about CSRF attacks. AFter researching, I found out that CSRF protection was added to Codeigniter v 2.0.0 so I wouldn't worry about it. — CyberJunkie, Jun 05 '11 at 17:12

score 2 · Accepted Answer · answered Jun 05 '11 at 17:17

You can use either form helper and POST request with CSRF protection instead of url method: http://codeigniter.com/user_guide/libraries/security.html or your method with links but add some code to: 1 sanitize uri segment, 2 add a token described in cabaret's link

Codeigniter securely delete db entries

1 Answers1