Passing ID with CodeIgniter

Question

Busy building my first web application in CodeIgniter and wanted to work out the best way of gathering ID in my Admin function for Edit, Delete statements.

I realised I can use any of the following:

1. Pass the ID through the controller.
2. Collect the ID from the URI segment.
3. Collect the ID from a hidden form field.

Which is the best based on security concerns. i.e. People fiddling with the URL, etc.

Answer 1

If this is for an admin section, it should may no difference. Unless a user is authorized to view the output of say, the Admin Controller, they should see "page does not exist" for each one of those methods.

Answer 2

I prefer to use the URL for unique IDs, that way you get nice-looking URLs that people can bookmark. You shouldn't rely on how you pass the data for security, you should be doing input validation within your controller regardless of how you pass it.