And in 30 years you haven't heard of Authentication and Authorization? Simply changing the id in url doest automatically give you the data for that id if you are not a logged in user to whom it belongs...