如何在使用GET和POST方法时添加安全性？

Question

I developed a small application Contact Manager and while updating the contacts, the contact id is being sent using GET method. But a user can change the Id and edit any contact, how can i add security to it?

<td>
    <a href="home.php?action=update&amp;contactid=<?php echo $contact->contact_id; ?>">Update</a>
</td>

http://localhost/contmanager/home.php?action=update&contactid=1

If i change the id to some other number, another contact will show up.

Answer 1

You can't control what the client asks the server to do.

If you want to add restrictions on who can modify particular contacts then you need to Authenticate (username + password, client SSL cert, OpenID, etc) users and then check if they are Authorized (this will depend on the business logic you decide on) to modify the entry in question.