Security risk passing id in URL
The Wizard sets up the relationship between results and updae by passing the the record ID in the URL, which would allow anyone who has access to the results page the ability to see any record by typeing in different IDs into the URL. I can change the update button into a form and POST the ID, then code the recorset on updatepage to use a post rather than a GET>.
Is this correct? Is there a better way?