A local community sports club which is very popular, allows people to put their children on a waiting list, from a PHP page. It also allows them to modify details or delete from the list, by entering their email address and child name.
However they have had incidents whereby parents have managed to “move their children up the list” by deleting other peoples children, when they know email/child name.
Changed it so they had to enter email address and a code that was given when they first registered - but most people forgot code. Modified it so code was stored on a cookie, but then people tried to modify data from a different device
Can anyone suggest a way to get over this?
Thanks