When I was writing a website, I used the data modification function. I put the user ID in the input of type = 'den den '.

When I write a website, I have the data modification function. I put the user ID in the input of typehidden. when I write a website, I have the data modification function. I put the user ID in the input of type = 'hidd?
Is this especially insecure?
Where should I place the where conditions and where are the where conditions when the large network sites are modified or deleted?

Reply to discussion (solution)

No security issues
When you browse the materials, do you still put the id in the url?

No security issues
When you browse the materials, do you still put the id in the url?

?? Put it in the url ??? Okay.

It's okay to put it in the url. you have to verify the security on your server.
Isn't it possible to modify the data only for login users?

The key is where your input ID comes from. what should I do?

It's okay to put it in the url. you have to verify the security on your server.
Isn't it possible to modify the data only for login users?

The key is where your input ID comes from. what should I do?

A malicious user changes your ID to another ID? How to verify?
I would like to discuss with you where to place conditions such as id or code when writing this similar feature.

You cannot modify it if you put it in type = 'hidd '.
If you must modify it in the debugging tool, it's not a good guy.

If we want to prevent it, we can only:Unplug the network cable

It's okay to put it in the url. you have to verify the security on your server.
Isn't it possible to modify the data only for login users?

The key is where your input ID comes from. what should I do?

A malicious user changes your ID to another ID? How to verify?
I would like to discuss with you where to place conditions such as id or code when writing this similar feature.

After changing to another person's ID, how can I modify user information?
Then, do you not check the permission modification. do you not check whether you want to modify yourself?

It's okay to put it in the url. you have to verify the security on your server.
Isn't it possible to modify the data only for login users?

The key is where your input ID comes from. what should I do?

A malicious user changes your ID to another ID? How to verify?
I would like to discuss with you where to place conditions such as id or code when writing this similar feature.

After changing to another person's ID, how can I modify user information?
Then, do you not check the permission modification. do you not check whether you want to modify yourself?

How can I determine whether it is myself? Use session? You can simply use the hidden ID. simply use the ID in the session to see if it is needed.

Yes. if you log on successfully, you can remember an ID in the session, and then check whether the ID in the session is the same as the ID in the url or the ID of hidden during editing to determine whether it is yourself.