JavaScript downgrade?

h4x0rmx

First of all, sorry for posting here, but on the correct secton of the forum there's no much action going on.
My question isn't really about php.
Look, I'm working on a CMS. Let's say that I have a table that lists all the users, each user has a "delete" link to, obviously, delete the user:

<td><a href="javascript:confirmDelete('1', 'user_name');" >delete</a></td>

the function:

function confirmDelete(id, user_name){
	if (confirm("Are you sure you want to delete the user with name " + user_name + "?") == true){ 
		document.adm.mydelete.value = id;
		document.adm.submit(); 
	}
}

This is working perfectly as I want, don't know if it does it the best way, though.

What I want to do is get this thing to work, if JavaScript is disabled on the user's machine.
I was trying something like:

<td><a onClick="javascript:confirmDelete('1', 'user_name');" href="/delete.php?id=1">delete</a></td>

I was thinking that by submiting the form using javascript the link/href would not matter, but id does!

Can anyone help me to downgrade my script?
I will appreciate your help!

h4x0rmx

I got it working:

<a onclick="confirmDelete('1', 'user_name'); return false;" href="/delete.php?id=1">delete</a>

MarkR

That's a really bad idea, because it may encourage prefetchers to get the /delete.php?id=1 links. This would delete people that they didn't want to delete.

NEVER allow the user to create, delete or modify something through a HTTP GET. It's simply not the right thing to do. Some web browsers will prefetch links that they think you might click on.

One way is to create one form per button. This is ugly.

Another way is to create a submit button with a different value:

<button type="submit" name="delete" value="42">Delete</button>

Unfortunately MSIE has a, err, bug (or possibly "feature") which means that it is impossible to create a button with a different value from its label.

This bug in MSIE is incredibly annoying and stops this obviously nice technique from working (It works fine in other browsers). This behaviour is contrary to the W3C HTML4 spec on the button element - I think IE does it for backwards compatibility with previous broken versions of IE.

Another, slightly better way of doing it is to use the name of the button to specify what to delete:

<button type="submit" name="delete_42">Delete</button>

This even works in MSIE, but server-side it's a pain in the arse because you have to iterate $_POST to find delete_something.

Mark

h4x0rmx

I appreacite your comments, MarkR!
The problem here is that my client wants a link, not a button, not an image!
When I use js, I post the form on a POST method, though.
Is there another way of working around this problem?
Thanks in advance!