I have a multi user site which in which
usercan have many
restaurantcan have many
menucan have many
For security purposes, I was going to add a
user_id foreign key making a reference to the
user.user_id column from each of the pertinent tables. That way, when updating the data, I can use the
id of the row they are updating in combination with their
user_id (stored in a session at the application program level) to ensure they don't maliciously update or view another
- Is this a common practice?
- Is it still normalized to do this?
Responses to comments
The code is only running on a website I control. But I want to prevent a
user from accessing a row of data that he/she does not own, based on his/her
user_id value. For instance, at the application program level, if they send a GET request to
/menus/1 it will retrieve the row from the
menu table with the
id value of 1.