IDOR in PHP and Laravel — When Changing One Number Exposes Someone Else's Data

This is the fifteenth article in a series on PHP and Laravel application security.

So far we have covered:

Article 1: What your PHP logs actually look like during a SQL injection attack

Article 2: Why URL encoding can break PHP security checks

Article 3: The decode bomb problem — why unlimited URL decoding can be its own vulnerability