What are the potential pitfalls of using checkboxes for deletion in PHP scripts?

Using checkboxes for deletion in PHP scripts can potentially lead to security vulnerabilities such as Cross-Site Request Forgery (CSRF) attacks if not implemented properly. To mitigate this risk, it is important to generate a unique token for each form submission and validate it on the server side before processing the deletion request. 

<?php
session_start();

// Generate a unique token for the form submission
$token = bin2hex(random_bytes(32));
$_SESSION['csrf_token'] = $token;

// HTML form with checkbox for deletion
echo '<form method="post" action="delete.php">';
echo '<input type="checkbox" name="delete[]" value="1">';
echo '<input type="hidden" name="csrf_token" value="'.$token.'">';
echo '<input type="submit" value="Delete">';
echo '</form>';
?>
```

In the `delete.php` file, validate the CSRF token before processing the deletion:

```php
<?php
session_start();

if ($_SERVER['REQUEST_METHOD'] == 'POST') {
    if (isset($_POST['csrf_token']) && $_POST['csrf_token'] === $_SESSION['csrf_token']) {
        // Process the deletion request
        if (isset($_POST['delete'])) {
            foreach ($_POST['delete'] as $id) {
                // Delete the selected item
            }
        }
    } else {
        // Invalid CSRF token
        die('CSRF token validation failed');
    }
}
?>

Keywords

checkboxes deletion PHP scripts security vulnerabilities SQL injection

Related Questions