Question: Right now I have a few buttons on a webpage which have an ID stored as an attribute. The buttons allow the user to edit/delete specific data which belongs to the ID. How can I prevent that the user can simply manipulate the ID attribute which therefore will edit or delete different data?

I'm using the edit button as an example:

`<button type="button" title="Edit" class="far fa-edit eval-btn" id="252" name="edit-btn"></button>`

So now if someone is going to change the ID attribute it is possible to access data from other users, because the ID will be received with jQuery like this:

```
$('[name="edit-btn"]').on('click',function(event){
        var editid = $(this).attr("id");
        $.ajax({
        //DB Connection, access data
        })
});

```

How can I prevent this? Is there a way to hide the id or access the id differently from an HTML Element?

Answer: 
You can't.

The HTML document has been rendered to a DOM by the user's browser.

The user's browser belongs to the user and is under their complete control.

They can change anything they want there.

Do not blindly trust data coming from the browser (at least beyond "this is what the user wants" and even then only if you have suitable CSRF defences in place). Always verify it against data you store server-side.

---

How you do this depends on what type of data it is but, for example, if an HTTP request tries to edit a user's address then check if the address belongs to the currently logged in user.

Another example: If it tries to place an order then check that the item ID exists, is in stock, they are requesting a quantity you can supply, and calculate the price from what is stored in your database and not using data submitted in the form.
Indeed, you can't

You should make sure that the given data is correct. Never depend on the data given by the user. Always check your post, get and cookie data