Passing URL parameters, how to hide

I'm still confused over one aspect of URL parameters. As far as a form passing data back to the server, I understand about get, post and replace. Here is my problem. I have an update form. User is logged in to the system and needs to update whatever information. Right now I'm including in the link the user's ID, so when they arrive at the update page, their record will be displayed. The problem is all one has to do is change the ID number in the URL parameter in the update page and you can go to someone else's record. How do programmers generally get around this ? I must be missing something. Thank you, Stuart