Best way to Confirm a Delete

Question

I need some advice here. I have an application that will be
used by large groups of people. This application allows Super
Administrators (set in a database) to delete a group. A group has
an administrator, a supervisor and students.
Since it would be A LOT of work to re-enter a group, I want
to make it CONFIRM that the Super Admin wants to really delete the
group in question. I was thinking of a javascript confirm, but I am
not sure how to mix coldfusion with javascript AND people turn off
javascript - what is the best way to do this?
Suggestions?

Answer 1

Instead of running a delete you could create a column in your
table named 'IsActive' and update that from a default of 1 (
true) to 0 (
false). Then in your application you could only look at rows
in the table where IsActive = 1. In this way it appears to the user
as a delete occured but if they flub and call you up in a panic,
you can switch the false back to true and viola, its like it never
happened.
As for the meat of your question...you could create a form
and have that post to a page that says "Are you sure you wish to
delete this record?". You could pass the form variables, like row
ID, to a hidden form field on this page. Then submit this confirm
form page to your code to remove the row.
I would caution this approach because if you pass your row ID
as a form field there is nothing to stop the user from changing
that row ID locally and submitting a different value, perhaps
removing something they do not have rights to remove.
This may or may not be an isue with your application. If your
application allows the user to delete any row then it is of no
concern really. They won't edit the HTML locally to change a row id
and submit if they have an interface already created which does the
same thing.
However if it is a problem for users to delete other rows you
can minimize the risk by passing the ID encrypted (Look at
Encrypt() and Decrypt() functions). Additionally updating your row
on a ID with a UUID datatype makes it even more difficult to edit.
For example, it's easy to change:
<input type="hidden" name="RowID" value="3">
to
<input type="hidden" name="RowID" value="1">
than it is to change:
<input type="hidden" name="RowID"
value="989FF13D-C6EE-0CCF-2E7065237D5FA12C">
to something meaningful.
I hope I didn't add confusion to your problem however I think
its important to create applications which are secure by design. If
your security is too tight you can always loosen the reigns later
which is better than getting caught with your pants down.