title: PHP More Secure Way To Redirect
body: <p>I have a php page which does an insert and then does a redirect to a "success" page which displays the order details.  I am redirecting by using a variable, but I am thinking this is not so secure:</p>
  
  <p><code>header("location:success.php?id=$orderid");</code></p>
  
  <p>This generates a url like this: <code>success.php?id=22</code></p>
  
  <p>I am then using the URL to obtain the order ID number and doing a query based off of that to present the order details:</p>
  
  <pre><code>$getName = explode('?id=', $_SERVER['REQUEST_URI']); 
  $id = $getName[1];
  
  $query = &lt;&lt;&lt;SQL
  SELECT * FROM `order` WHERE `orderid` = ?;
  SQL;
  
  $request = $mysqli-&gt;prepare($query);
  $request-&gt;bind_param("i", $id);
  $request-&gt;execute();
  </code></pre>
  
  <p>The obvious issue is that anyone could simply change the URL id number to get the details of a different order number.  I'm not too terribly concerned as this is strictly an internal site, but I'd still like to fix this behavior.  Is there a better, more secure way to do this?</p>