Symfony2 - Using the Delete Form in a CRUD Operation

Question

the adutomatic crud operation created by symfony as well as the symfony demo application has the following code structure for the delete action

    /**
     * Deletes a testing entity.
     *
     * @Route("/{id}", name="testing_delete")
     * @Method("DELETE")
     */
    public function deleteAction(Request $request, testing $testing)
    {
        $form = $this->createDeleteForm($testing);
        $form->handleRequest($request);

        if ($form->isSubmitted() && $form->isValid()) {
            $em = $this->getDoctrine()->getManager();
            $em->remove($testing);
            $em->flush();
        }

        return $this->redirectToRoute('testing_index');
    }

    /**
     * Creates a form to delete a testing entity.
     *
     * @param testing $testing The testing entity
     *
     * @return \Symfony\Component\Form\Form The form
     */
    private function createDeleteForm(testing $testing)
    {
        return $this->createFormBuilder()
            ->setAction($this->generateUrl('testing_delete', array('id' => $testing->getId())))
            ->setMethod('DELETE')
            ->getForm()
        ;
    }

My question is: why do we need a form to delete? maybe we have a link in the branch with the parameter id, so we can’t do the following: why should we check if the object exists isValid()inside the form before it is deleted?

    /**
     * test delete
     * @Route("/{id}", name="testing_delete")
     * @Method("DELETE")
     */
    public function deleteAction(testing $testing) {
        $em = $this->getDoctrine()->getManager();
        $em->remove($testing);
        $em->flush();
        return $this->redirectToRoute('testing_showall');
    }

Answer 1

If you used a delete link with an identifier, perhaps the robot can delete your data using a loop.

Symfony DELETE, , crsf isValid "$ form- > isValid()"

Answer 2

HTTP ( , GET URL):

(, HEAD, GET, OPTIONS TRACE) , , . , [...]

Answer 3

, , CSRF.

Symfony, CSRF, , , , , . /{id}, XSS, - .

XSS - , () , , . , , , . .

CSRF- CSRF. Symfony , isValid().