Security question

[eluser]Aea[/eluser]
As long as you verify the user is "valid" for deleting said post (moderator, owner) you're "okay." The problem comes in people giving users that address to spoof them to deleting their own stuff, you can get around this problem by having a confirmation page, or sending the postID via POST (that way a simple url won't let a user delete something).