I have set some users with 'update' access to some books and all other users have only 'view' access. I have used hook_node_view_alter() to remove the 'Add child page' link for users with 'view' only access. The problem this only hides the link from the corresponding node pages, those users are still able to add a child page by manually going to the url: /node/add/child-content-type?parent="mlid" where mlid is the "menu link id" for the parent node. The users might not know particular parent node link id's, however this is a security hole I want to get rid of.
How can I get this passed argument as "?parent=" in a php variable and what hook function should I use to run the condition checks for user access? I am using drupal 7.