使用PHP会话防止字段编辑

Question

Is it a good idea/good practice to use a PHP session variable to protect against users editing hidden/input field values? For instance, lets say I have the following fields:

<input type="hidden" object_id="1" />
<input type="text" object_id="2" />
etc...

I need to have the object_id on the front end so I can tell which database entries need to be manipulated when the user submits (providing they are authorized to act on the data). The $_SESSION variable would look something like [obj_id = 1, obj_id = 2]. Part of the authorization process makes sure that all of the entries the user is trying to act upon are present in the session. If there is some discrepancy (e.g. an element with object_id="3") the user is not authorized.

Are there solutions that are more widely accepted or does something similar to this usually suffice?

Answer 1

Generally, you still need to trust the end user to provide you with the correct data to be modified. The only thing that you can verify in that context is that the values provided look like valid data to be inserted into the database, and this is usually the databases job itself, as what is valid data is the database table's state to determine.

There are many ways to approach this. Unless I knew more about what you are trying to do, I cannot provide a sound detailed solution.

Good luck