I am developping a module which allows users to modify information about themselves using a form. I want to make sure no user is able to modify the informations about another user. To do this, I thought I could use the uid provided in the
$user global variable. So my question is: is this safe enough? Or is it somehow possible for
$user->uid to return something other than the current user's uid? In other words, is it possible to cheat the
$user global object?
This is not the best way to ask this question, feel free to suggest improvements.
edit: Another way of asking this is: Does $user->uid return something different than 0 only in the case where the current user has been properly authenticated?