Daten prüfen mit php ajax

[Jeremygolf]

Hallo zusammen,

in meinem App hat jeder user daten, die man auch löschen kann. Nun muss ich aber verhindern, dass jemand daten eines eines anderen löschen kann. Ich gebe also mit ajax die objectid mit und prüfe in php ob der user owner dieses objected ist.
Bitte um ratschläge um meinen code zu verbessern und zu sichern. Danke

Hier ist mein code:

View:

<div class="col-md-12 profile-rounds">
        <div class="panel panel-default panel-primary rounded-border">
         <!-- Default panel contents -->
         <div class="panel-heading">Rounds</div>               
         <!-- Table -->
         <? if($data['rounds']): ?>
         <table class="table">
            <thead>
                <tr>
                    <th width="20%">Datum</th>
                    <th width="50%">Course</th>
                    <th width="30%" class="text-right">Action</th>
                   
                </tr>
            </thead>
           
            <tbody>
           
                <?php
                    foreach($data['rounds'] as $round){
                        echo "<tr>";
                        echo "<td>" . $round->date . "</td>";
                        echo "<td>" . $round->name . "</td>";
                        echo '<td class="text-right button-action"><a class="btn btn-default" href="' . DIR . 'round/edit/' . $round->roundid . '">Edit</a>';
                        echo '<a class="btn btn-danger deleteRound" data-roundid="' . $round->roundid . '">Delete</a></td>';
                        echo "</tr>";
                    }
                ?>
            </tbody>
         </table>
         <? else: ?>
         <div class="panel-body">
                <p>No rounds entered</p>
         </div>
         <? endif; ?>
        </div>
    </div>

JS:

<script>
    $(function() {
        $(".deleteRound").click(function() {
            $post = $(this);
            swal({  
                title: "Do you want to leave this Group?",  
                //text: "You will not be able to recover this imaginary file!",  
                type: "warning",  
                showCancelButton: true,  
                confirmButtonColor: "#DD6B55",  
                confirmButtonText: "Yes, delete it!",  
                cancelButtonText: "No, cancel plx!",  
                closeOnConfirm: true,  
                closeOnCancel: true 
            }, 
            function(isConfirm){  
                if (isConfirm) { 
                    $.ajax({
                        url: '<?php echo DIR . 'round/delete'?>',
                        method: "POST",
                        data: {roundid : $post.data('roundid')},
                        success: function(msg) {
                            alert(msg);
                            $post.parent().parent().fadeOut(200);
                        }
                    });  
                } 
            });
        });
    });

</script>

Controller

if(isset($_POST['roundid'])){   
            $info = $this->_model->getRoundInfo($_POST['roundid']);
           
            if($info[0]->userid == Session::get('userid')){
                $data = array(
                    'roundid' => $_POST['roundid']   
                );
               
                $this->_model->deleteRound($data);
            } else {
                echo json_encode("Good try");
            }
        }