php - How to protect form data on my site? -

i have page posts data url. tried using curl didn't work since need user redirected destination website , curl bringing current one. i'm doing is

<form action='http://destination.com' method='post' name='frm'>  <input type='hidden' name='account_id' value='<?php echo $_session["accont_id"]; ?>'> </form> <script>  document.frm.submit(); </script> 

but totally insecure, , user using program charles proxy can intercept , change data. there way protect it? validation won't job because users aware of kind of data database have, know everyone's account id , can't change that. can do? maybe encryption work? if user able change data it's ok long can't change other valid account's id. i'm thinking in secret/hash can't put in mind.

i tried using this:

$url = 'http://www.destination.com';  $curl = curl_init();  curl_setopt($curl, curlopt_httpheader, $header);  curl_setopt($curl, curlopt_followlocation, 1);  curl_setopt($curl, curlopt_autoreferer, true);  curl_setopt($curl, curlopt_url, $url);   curl_setopt($curl, curlopt_post, 1);   curl_setopt($curl, curlopt_postfields, 'account_id='.$_session["account_id"]);   curl_exec($curl); curl_close($curl);  echo "<meta http-equiv='refresh' content='0;url=http://destination.com'/>"; 

but page redirected , no data arrived. post wouldn't go through

the bottom line of discussion in comments above results in approach try do:

you make curl request remote system posting user id, server server. remote system creates random token (random 32 char string) , returns that, stores token posted user id later reference. local system sends redirection header client includes token. leads client making request remote system claiming token handed. remote system checks stored token, can derive user id it, create user session , delete token.