How to validate the authority of the contents when update

Question

We click edit button in the list page when we want to revise some contents, and it will go to detail page with id that I set Insert, update, delete function by wizard, but if I change the id by myself, it showed other person's contents, and I can revise it successful, how to prevent that.

Answer 1

I use POST to call problematic forms, which should be the default! I call a query to check that the current login_id is the owner of the form to be updated, if not, redirect back to the previous page.
In addition to login_id I think there should be a session hash passed in the post variables, and this should be checked in the same way. (See techniques for preventing CSRF hack techniques, it is the same principal)
// GWB Restrict access to current user
if (isset($_POST['uniqueid'])) {
$host = $_SERVER['HTTP_HOST'];
$uri = rtrim(dirname($_SERVER['PHP_SELF']), '/\\');
$extra = 'includes/nxt/back.php';
if ($_SESSION['kt_login_id'] != $row_rs_CheckCurrentUser['ua_UniqueID']) {
$extra = '../includes/nxt/back.php';
mysql_free_result($rs_CheckCurrentUser);
header("Location: http://$host$uri/$extra");
exit;
// End GWB Restrict access to current user