On my site, I restrict access to forms through assigning a $_SESSION['id'] if they are logged in.
If there is no $_SESSION['id'], to form page will redirect to a login page.
But I ran burpsuite on my site, and it had access to these forms when I spider'd my domain. BURP was even able to submit POST data, and it wound up appearing in my database.
Is there a term for this, and how can I stop it?