title: How to uniquely identify a user, before updating just their info in the database - asp.net/jQuery
body: <p>I'm just looking for "best practice" reassurance on working with jQuery and ASP.Net, before working on my new project.  I'll take a simple example.  </p>
  
  <ol>
  <li>A user logs on to my website, using forms authentication </li>
  <li>Their userID is stored in the Session("userID") variable </li>
  <li>When logged in, their screen shows a list of cars available</li>
  <li>The user wants to re-order them into preference order, which is then posted back to an aspx web page from jQuery</li>
  </ol>
  
  <p>What is the best way of uniquely identifiying the user, so that only their preference order is updated?</p>
  
  <p>Should I use the Session("userID") on the server side, to ensure it's only that users data that is updated?</p>
  
  <p>Or when creating the page, should I "send" the unique userID to the browser, and store in a label on the screen, and then post that back to the aspx webpage, when the update is made?  Or is that a huge security hole - in so much as if I post a uniqueID to the browser, the user could change it before posting the data back by jQuery, thereby updating another users information?</p>
  
  <p>Thanks for any guidance,</p>
  
  <p>Mark</p>