I have encountered this issue several times and have found what I think is the simplest solution. Since your user can edit (personal/account?) information, I assume you have some kind of authentication system up and running. If you use sessions to keep track of recognized clients you can store the user's ID inside it. Then you can fetch the ID from the session when the appropriate page is requested. You would have to change your URL structure to
users/edit (or something similar) so that is does NOT have any sensitive information.
Now you have hidden the sensitive data from the URL. This also comes with a bonus. Imagine a user linking his current URL (your old structure with the ID) in an email and the recipient clicks it. Your validated user have now unwillingly given away his/hers ID.
- Remove the user ID from the URL structure
- Store the user ID inside a session
- Change the URL structure to NOT include any sensitive information
- Fetch the ID from the session when the appropriate page is requested
- Continue business as usual
If the ID inside the URL is a requirement you can "borrow" some of the concept from the above. If you store the user ID inside the session (or your used temporary storage of recognized users), you can compare the ID from the URL against it. If it matches we are good to go, otherwise we can show and error, logout the user and so on.
Hope this can help you, happy coding!