This is a short but general question. I am relatively new to programming in general. My site, which is predominately written in PHP, will be launched soon and is undergoing some security tightening. This started with converting the whole thing to PDO with prepared statements (from what was a MySQL set up) to making sessions more secure.
My issue is this: I make quite a lot of use of the
$_GET superglobal to pass user IDs around and thread IDs in the Q/A section. If a member clicks on another member's pic, they are sent to that user's profile page invariably using a
$_GET['id'] to send the info - usual newbie type stuff.
I am concerned that this may pose a security risk as the members' ID numbers are essentially visible throughout the site.
I am not sure that creating forms with hidden
$_POST variables is the answer. I have searched for answers on this, without success regarding this exact question.
I know this is not code, but I would appreciate some steerage on whether this actually does represent a problem, and if so, how.