Restrict user from hacking and entering a state_id