title: Web Apps: Storing ID in hidden fields safe?
body: <p>I just had this thought, I don't know if I am slow though. </p>
  
  <p>Usually, I store the id of the item I am editing in a hidden field. Then in backend (I am using PHP/Zend Framework btw), I get it to determine which item gets edited.  But then I thought, in something more secure, eg. edit profile, the user can somehow edit a hidden field right?  Then he can edit someone else's profile. I know for edit profile, I can get the id form the session variable, but what if i got something that requires me to store the id somewhere?</p>
  
  <p>I got ACL (Zend_Acl) I do this. Basically grab the id from the request params</p>
  
  <pre><code>$id = $req-&gt;getParam('id');
  </code></pre>
  
  <p>then check if the logged in user is allowed to edit the item. But the thing is I wonder if the url is something like <code>/users/edit/1</code> where 1 is the id. But somehow, the hidden field is changed to 2, what will the request param be? </p>
  
  <p>How would you deal with this?</p>