RE: [PHP] Munging hidden/form variables

[Boget, Chris]

> Don't bother with checking the HTTP_REFERER - it can be easily forged.
> There is a very simple solution to this problem -- validate the data from
> the form!
[snip] 
> You should be doing this anyway, since who knows what the user could 
> type in your input box. Nevermind if somebody makes a copy of your 
> form. Never never never trust the client.

I'm already doing this.  However, if I have a hidden variable containing
a value of the current user I'm working with, that value can be changed
to something else and it would pass the test.  However, I need to find a
way to determine if something like that has happened.  That's where my
description of what I was thinking of doing came from.

Chris