title: Check if row exists so user cannot tamper with input
body: <p>NOTE: I've edit the whole post, trying to make it clearer.</p>
  
  <p>I'm terrible at getting my question clear, but this is my last try.
  I got this which gets sent when clicking the button;</p>
  
  <pre><code>                echo"Auto/Prijs&lt;br&gt;&lt;br&gt;&lt;select name='autos'&gt;";
              echo"&lt;br&gt;&lt;br&gt;";
  
              $sql = "SELECT `garage`.`id`, `car_id`, `schade`, `naam`, `prijs` FROM `garage` LEFT JOIN `cars` ON (`garage`.`car_id` = `cars`.`id`) WHERE `user_id`=".ID." ORDER BY `id` ASC LIMIT ".($page * 10).", 10";
  $sql = mysql_query($sql) or die(mysql_error());
      $i = 1;
  while($res = mysql_fetch_assoc($sql)){
      echo"
  
  
  &lt;option value='".$res['car_id']."'&gt;".$res['naam']."&lt;/option&gt;&lt;br&gt;
      ";
  </code></pre>
  
  <p>This is a dropdown, showing carnames instead of car_id's.
  Now, the car_id is not unique, but refers to a car. The 'id' in the 'garage' table IS unique. Am I able to like call the 'id' too, and on sending check if that ID is actually the sent 'car_id'? Because, you can tamper the sent car_id and simply change it.</p>
  
  <p>This happens on sending:</p>
  
  <pre><code>if(isset($_POST['start'])){
  $prijs = $_POST['prijs'];
  $carr = $_POST['autos'];
  $sql = mysql_query("SELECT `id` FROM `automarkt` WHERE `seller_id`=".ID." LIMIT 1") or die(mysql_error());
  mysql_query("INSERT INTO `automarkt`(`seller_id`, `prijs`, `car_id`) VALUES (".ID.", ".$prijs.", ".$carr.")") or die(mysql_error());
  </code></pre>
  
  <p>I'm out of idea's, and can't get clear enough on what I need to do. I need to check if the sent car_id is actually in the 'user''s garage. (Trying to do it by checking the unique entry 'id' in the 'garage' table.</p>