How to deny access if url is changed manually? Maybe the way I'm doing this is not the correct one but here it goes.

I have a page in my site where I have a form. In that form I have a select list that I fill with user ids from a query.

So for example, my site has 10 users and the list will be filled with only user 3 and 7.

When I submit the form, the url is changed to have the uid as a parameter:
&amp;user=3 or
&amp;user=7

My problem is that I can change the url manually to other user I want and I'm not denied the access.

How can I deny access in this case?
I've managed to solve this.

In my hook_form I have:

$querystring = drupal_get_query_parameters();


So for this case I just need to check if the user in the url is in the array of users allowed. If not, I can deny the access to the page (I still don't know how to deny the access though)