How to secure this PHP form
<p>I have a form for editing users.  The user ID is passed to the client (in a hidden field) so that I know which user to update when the form is posted back to the server.  My question is, how can I guard against users changing the ID in the DOM, thereby updating a record to which they should not have access?</p>

<p>The only ways I can think of are:</p>

<ol>
<li>Save the user ID in the session.  (Painful).</li>
<li>Run a salted hash on the user ID (and perhaps other form elements) and include it also as a hidden form element.  (Not particularly secure?)</li>
</ol>

<p>Are there other approaches?</p>

<p>Thanks!</p>

<p>EDIT: Hey, some great responses coming in.  Note that the logged in user and the user being edited may be two different users, e.g. a Manager is editing a Staff record.</p>
