And in each, you're matching these IDs to the primary key in the database. For example, your code excutes this:
DeleteUser(1234). What if I change it to
1? What if I delete every single user? What if I delete the first user, who could presumably be the
Or what if I were allowed to update a single user's record, but I change the ID to
make myself the admin?
UpdateUser(1) instead of
Sounds like your code might be vulnerable to a direct object reference exploit.