AJAX验证正确的用户

Question

I'm using AJAX to delete posts from a forum.

The code does it so that the delete icon only shows if the session variable "user" equals the one in the database. This works perfectly so no need to include the code for that here i believe.

However, in theory, couldn't anyone just read the javascript code, go to the file where everything is processed and delete whatever they want?

My idea to fix this is to send over an additional variable with the username and check it once more on the processing page.

Ajax code:

    $('#deletePost').click(function() {
        var xhttp = new XMLHttpRequest();
        var getId = <?php echo $_GET['id']?>

        xhttp.onreadystatechange = function() {
            if (this.readyState == 4 && this.status == 200) {
                var replace = confirm("Your post was successfully deleted. Click OK to return to the homepage.");
                if (replace == true) {
                    location.replace('index');
                } else {
                    location.reload();
                }
            }
        }
        xhttp.open('GET', 'deletepost.php?id=' + getId, true);
        xhttp.send();

        return false;
    });

To explain my concern more deeply: Anyone can see the file where the information is processed, so they could just go to

http://www.website.com/deletepost.php

Then just apply any id they want so the url becomes something like

http://www.website.com/deletepost.php?id=22

And because there is no validation on the second page this would work.

<?php

if (!isset($_GET['id'])) {
    echo 'e';
} else {
    $id = intval($GET['id']);
    $sql = 'DELETE FROM posts WHERE post_id=' . mysqli_real_escape_string($conn, $id);
    $result = mysqli_query($conn, $sql);

    if (!$result) {
        echo 'Failed to delete your post. Please try again or contact administration.';
    }
}

?>

So if anyone has any idea on how to validate this it would be very much appreciated. If anything is unclear please comment and I'll fill in.