Not going to lie, every time I'm on a website with some sort of ID in the URL, particularly more obscure ones, I can't help but tamper with it. Try putting quot

Not going to lie, every time I'm on a website with some sort of ID in the URL, particularly more obscure ones, I can't help but tamper with it. Try putting quotes in it, try making it a negative value or changing it to nearby values. I've found a disturbing number of SQL injection and XSS attacks like this, just messing around on obscure sites. I run a small business and have noticed our customers try to do the same sometimes, their user ID is visible in the URL at some points. I see the error logs saying they tried to load something they didn't have permission for at least a few times a month. Do you think there's a serious legal risk here, assuming I don't perform any bad queries on the DB but just see an error message from it and assuming I don't give anyone an XSS'd link, just from plain toying with URLs?