title: Is it safe to use GET method for deleting information from a database?
body: <p>I'm creating a website where users will need to be able to upload images, and I'd like them to be able to delete those images. Right now, I have a page that will display all of the images that that user has uploaded, and I have a php set up to delete an image from the database. It just needs to be given the id of the image. I have it functioning with the GET method, but I'm concerned a user could find the URL for my delete php and put in random ids, deleting everyone's images. Is there a way I can adjust my code to make it safer?</p>
  
  <pre><code>&lt;?php
  $sql = "SELECT id, userid, name, image FROM images";
  $result = mysqli_query($conn, $sql);
  if (mysqli_num_rows($result) &gt; 0) {
      // output data of each row
      while($row = mysqli_fetch_assoc($result)) {
          if ($imageUser == $row["userid"]){
              echo "&lt;tr&gt;";
              echo "&lt;th&gt;".$row["userid"]."&lt;/th&gt;";
              echo "&lt;th&gt;".$row["name"]."&lt;/th&gt;";
              echo "&lt;th&gt;&lt;img src='showimage.php?id=".$row["id"]."'&gt;&lt;/th&gt;";
              echo "&lt;th&gt;&lt;a href='imgdelete.php?id=".$row["id"]."'&gt;delete&lt;/a&gt;&lt;/th&gt;";
              echo "&lt;/tr&gt;";
          }
      }
  } else {
      echo "0 results";
  }
  
  ?&gt;
  </code></pre>
  
  <p>The delete.php simply deletes the entry WHERE id=$_GET['id'];</p>