title: Should you protect the table row id when processing a form request?
body: <p>This is a security "principle" question... </p>
  
  <p>This form includes a hidden field, which gets included in the POST request, and tells the server-side code which row in the database table to update (assuming all the fields have been properly validated)</p>
  
  <pre><code>&lt;form method="post" name="update"&gt;
  &lt;p&gt;&lt;input name="table_row_index" type="hidden" value="102" /&gt;&lt;/p&gt;
  &lt;p&gt;&lt;input name="Name" type="text" value="Adam Black" /&gt;&lt;/p&gt;
  &lt;p&gt;&lt;input name="Submit" type="button" value="Submit" /&gt;&lt;/p&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>Couldn't someone edit the HTML and change the "table_row_index" value to a valid number and thus overwrite a row they shouldn't have access to?</p>
  
  <p>So, my questions really are...</p>
  
  <ul>
  <li>Should you use the table index in the form as the row id?</li>
  <li>If not, how would you tell the PHP which row to update? (please assume the form is not page specific... the contents are updated as per a user action).</li>
  </ul>