I am building a simple Q&A app with PHP, HTML and JS. I have three tables:
answers, each table has it's own primary key and
answers both have foreign key constraints.
users.uID to look up author, and
question.qIDto identify which question they belong to, and also author that wrote the answer, so
users.uID is also foreign key.
And here is my main concern: how to properly implement submit button for answer, that passes the author ID and also question ID that is supposed to be inserted in
answers table via ajax request, so it has to get that ID from somewhere. The main concern is not XSRF, but the fact that authorised user could tamper with it, by changing a part of html code if the ID is stored visibly (or invisibly) somewhere.
User ID is easy, that can be stored in session once retrieved from DB and user logs in and will be reused elsewhere too so no big deal in term of performance costs, and can be accessed by all scripts while hidden from user. But also storing the question ID in session, each time user visits a question, and then replacing that with another question ID when he visits another question seems to me like it is asking for causing heavy load on server at some point.
Adding hash to the submit button, that is then validated by script that processes the ajax call data looks cumbersome to me too, since you have to store that hash in session too. And using hidden field is not safe either, since user can see that field in source code and can tamper with it.
So where to efficiently store that question ID, so it is ready when the submit button is pressed and also that user cannot tamper with it, and send ajax call with other ID? Is the session really only option?