How can PHP developers ensure secure data handling when passing IDs for deletion from a database and file system?

PHP developers can ensure secure data handling when passing IDs for deletion by validating the input to ensure it is an integer and sanitizing the input to prevent SQL injection attacks. Additionally, developers should check if the user has the necessary permissions to delete the data before executing the deletion operation. 

// Validate and sanitize input
$id = filter_input(INPUT_POST, 'id', FILTER_VALIDATE_INT);
if (!$id) {
    // Handle invalid input error
}

// Check user permissions
if (!hasDeletePermission($id)) {
    // Handle permission denied error
}

// Delete data from database
$deleteQuery = "DELETE FROM table WHERE id = ?";
$stmt = $pdo->prepare($deleteQuery);
$stmt->execute([$id]);

// Delete file from file system
$file = "/path/to/files/" . $id . ".txt";
if (file_exists($file)) {
    unlink($file);
}

Keywords

SQL injection prepared statements file deletion data sanitization error handling

Related Questions