Performing mysql update based on passed variable from link? - php

Question

I've built a list of links based off of an array from a select query.
Linking to the page in question works fine, but I've added a link option to each to delete the page in question. The only issue is, I'm wondering the best way to pass the page ID of the given page into the query that deletes (deactivates) the page.
I build my page links like this:
<?php foreach($result as $page): ?>
<div class="col-lg-3 col-sm-6 d-flex" style="padding-bottom: 20px;">
<div class="card text-center flex-fill">
<h2><?php echo $page["title"] ?></h2>
<p><?php echo $page["Name"]?></p>
<a target="_blank" href="showpage.php?pageid=<?php echo $page['id'] ?>">View Page</a>
Edit Page
Delete Page <!--this is where I need to pass $page['id'] and use it in the query below-->
</div>
</div>
<?php endforeach?>
The query to delete/deactivate:
$deletePage = "
UPDATE pages
set active = 0
where id = /*this is page ID from previous link*/
";
$performDelete = $mysqlConn->query($deletePage);
What is the best practice for me to pass the pageID of the link into this query?

Answer 1

You're passing the target page through as a URL parameter on the first page, so it will be available on the second page via $_GET, so the standard structure would be:
$deletePage = "UPDATE pages set active=0 where id=$_GET['pageid']";
However, note that the above is open to attacks; it's trivial for a user to simply modify the value in their address bar, and thus update the wrong row. In fact, with a bit of SQL injection, it's even possible for a user to completely delete your entire database with the above PHP / SQL.
The best way to avoid this is paramaterised queries (I assume MySQLi in the following):
$stmt = $mysqlConn->prepare("UPDATE pages set active=0 where id=?");
$stmt->bind_param('i', $_GET['pageid']);
$stmt->execute();
Note that you'll still want to assure that the user viewing the page is authorised to make the UPDATE command, most likely by checking against their $_SESSION.

Answer 2

Pass it in link and get it in second page using $_GET['id']
Delete Page