I have a url like this (that you need to be logged in to see):
<https://www.example.com/form.php?id=268>

form.php is for users to update details on a particular db entry (in this case id 268)

The application basically gets the id no, validates and sanitises it, runs a mysql query and then fills the form out with the results of the query.

In the query I use the id from the url plus a session variable $\_SESSION['company\_id'], which is set at login. That means if a user manually changes the url to (for example) ?id=269 he / she will only be able to see the details of id 269 if the company\_id matches that of the company\_id set in the session variable.

I'm confident that the url id will be OK / safe, but the session variable worries me. I'm not performing any IP or user agent checks on the session variable before I run the mysql query, which makes me feel a tad exposed. So...

1. Do you think I should encrypt $\_SESSION['company\_id'] for extra security?
2. Do you think it is worth running a user agent check before running
the query? Does this add any security value?

--

**Update**

Have rewritten the question and title to try and be more specific