Technique to validate foreign keys, MVC web application, MySQL - mysql

Question

Having two database tables:
orders (id, client_id, ...) - stores orders of customers
addresses (id, client_id, ...) - stores delivery addresses of customers
Relationship between that tables is many-to-many so I have table
addresses_orders (id, order_id, address_id) which maps where order goes
But I'd like to enforce one thing - in table
addresses_orders can only be paired together orders and addresses of the same customer.
What is the best way to do this?
I have web application based on MVC, which stores data in MySQL database.
Every customer gets only his orders and addresses to choose from, but form can be tampered and malicious user can change address_id to random guess, so it will produce described insonsitency.
For safety I have to validate against this scenario - probably in Model or directly in database.
I prefer second solution, but how to do this? Maybe some triggers?

Answer 1

If there are no overlap in addresses ( only one client per address ), Then your DB structure makes no sense.
Clients Addresses Orders
--- ------- -------
client_id PK address_id PK order_id PK
name client_id FK address_id FK
phone_number full_address data
Then to get all details from an order
SELECT
Clients.name
Addresses.full_address
Orders.data
FROM Orders
LEFT JOIN Addresses USING(address_id)
LEFT JOIN Clients USING(client_id)
WHERE
client_id = 42
This would give you all orders from client with ID 42.
each order has one address
each address has one client
each client has multiple addresses
each address has multiple orders

Answer 2

Is the address_id hidden or visible form field and you are worried that users are capable or willing to mess with it?
I'm guessing your customers are logged in. You could take advantage of session information and user_id (or something). Retrieve the customers address_id in the process file and use that address_id, not the id sent by form (you could of course check if they match). If something goes wrong the problem is probably somewhere in session/application security, but not in the spoofed form.

Answer 3

We tend to use the following approach:
a) Store the customerid in the session
b) When selecting the orders or addresses use one of the following showing the user names while saving the ids:
- A pregenerated list using a select control where only one can be selected
- A pre-generated list from which specific items can be selected using checkboxes