I'm working on an application which allows a moderator to edit information of user. So, at the moment, I have URL's like
I'm a bit worried here, as I'm directly exposing the users table primary key (ID) from the database. I simply take the ID from the URLs (for ex: 1 and 2 from above URLs), query the database with the ID and get user information (of course I am sanitizing the input - ID from URL).
Please note that I'm validating every request to check if moderator has access to edit that user.
Is what I'm doing safe? If not, how should I be doing it?
I can think of one alternative i.e. have a separate column for users table with 25 character key and use the keys in URLs and query database with those keys.
- What difference does it make? (Since key is exposed now)
- Querying by primary key yields result faster than other columns