I am currently working on functionality that will allow users to reset their passwords. My question pertains to the security in putting user ID's (a.k.a the auto increment ID's from database) in the URL so during the password reset process I can use that ID to fetch their secret questions, their token, and to reset their PW's.
I am aware of validation of the URL string as only these characters are allowed in the URL bar :
also I am aware of encoding and escaping as when I query the DB and append the users ID I run it through urlencode and when I put it into query I run urldecode to get it back to its most natural value (the db value) that I first queried before appending it the URL.
Am I missing anything? I guess one of my fears is what happens if someone enters in another users ID for possibly trying to DOS another user? Keeping in mind I only append the user ID after the user has clicked on the email verification link. Am I going about this correctly?
Any clarifications would be very nice. Thanks in advance.