can users trigger javascript: function from URL?
<p>i have a function that calls javascript:del_release_comment(10,12); from the page, if the user has that particular comment.</p>

<p>I wonder if other users can trigger from the URL bar or somehow else this function to delete comments that aren't their.</p>

<p>10 is the news_id and 12 is the comment_news_id, the id of the comment on that particular news.</p>

<p>THe delete is done via AJAX calling a PHP script that does delete on these 2 parameters.
If the javascript function can be called by hand i'd have to re-enforce the little PHP script that deletes the comment. Also, is it possible to call that particular PHP script by name in the URL directly ? It uses _POST vars, not GET.</p>

<p>Thanks.</p>

<p>code for deleting the comment : </p>

<pre><code>$query_del_comment = "DELETE from myl_news_comments WHERE comment_id='".mysql_real_escape_string($_POST['comment_news_id'])."' AND news_id='".mysql_real_escape_string($_POST['news_id'])."'";
$result_del_comment = mysql_query($query_del_comment) or die('Query failed: ' . mysql_error());
</code></pre>
