If you are trying to stop users from manipulating the url, you can use a csm of the url to validate it. I have been using this method for years, to prevent people from changing the id in a url to edit a record that they shouldn't be editing (I usually have 2 or 3 checks to make sure its the right person, not just the url csm though).
Here is function that I just made (it only works if you are using the $_GET superglobal though, a different function would be required for something else):
To test, just put on its own page and run. You will be able to see how it works.
function url_csm( $url,$to_html=true,$remove_csm=false ) {
$url = trim( $url,'/' );
$md5 = md5( $url . SALT );
$vars = array();
if ( ( $pos = strpos( $url,'?' ) ) !== false ) {
$data = substr( $url,( $pos + 1 ) );
$url = substr( $url,0,$pos );
$data = explode( '&',$data );
foreach( $data as $datum ) {
list( $key,$val ) = explode( '=',$datum,2 );
$vars[$key] = $val;
}
}
if ( isset( $vars['csm'] ) && $remove_csm == true ) {
unset( $vars['csm'] );
}
else {
$vars['csm'] = $md5;
}
$query_string = array();
foreach( $vars as $key => $val ) {
$query_string[] = "{$key}={$val}";
}
return ( $remove_csm == false ? 'http://' . $_SERVER['SERVER_NAME'] . '/' : '' ) . $url . ( count( $query_string ) > 0 ? '?' . implode( ( $to_html == true ? '&' : '&' ),$query_string ) : '' );
}
function url_csm_valid() {
if ( !isset( $_GET['csm'] ) || md5( url_csm( $_SERVER['REQUEST_URI'],false,true ) . SALT ) !== $_GET['csm'] ) {
return false;
}
return true;
}
define('SALT','large random string here');
if ( !isset( $_GET['csm'] ) ) {
echo '<a href="' . url_csm( $_SERVER['PHP_SELF'] . '?testing=test' ) . '">Click here</a><br />';
}
else {
echo '<p>Now trying changing the key or value of the test var in the url</p>';
echo 'Checksum Valid = ' . ( url_csm_valid() == true ? 'Yes' : 'No' );
}
exit;
I think that is what you were trying to accomplish but I might be wrong.
Offline 
Unsolved 
