Q:

Django - avoid false records if the pk of a dynamic url is changed

I am designing an app where students can rate their teachers through a survey. 
Basically what the app does is it generates a dynamic url for each teacher, for example:

Teacher Mike : mywebsite.com/teacher/1
Teacher Brian: mywebsite.com/teacher/2

The numbers correspond to the PK of each teacher. The student fills out the survey and when sending it, first validates in the database that the answers have not been sent previously (to avoid duplicates). In case the answer has already been saved before, a page is displayed where it says this.
Everything works fine, but there is a problem if the user (student) performs a strange action. When the student rates for example the  Teacher Mike :  the url that is generated is mywebsite.com/teacher/rate/1 and shows a template that says that the answer is saved. The problem comes here:
If the person at that time changed the number(pk) in the url, for example from 1 to 2, the app saves the teacher-1's answers in the teacher-2's record. 
clarification: if the student is assigned teachers 1, 2 and 3 and changes the pk in the url to 5, there is no problem since the app detects that the student does not have permission to grade that teacher. The problem is if it is changed from 1 to 3, for example, since the student has permission to grade both students.
I know it's strange behavior. But I'd like to find a way to solve this.
The view for submitting the answers is this:
def send(request, user_pk):
    if not request.user.is_authenticated:
        return HttpResponseRedirect('/accounts/login/')
    else:
        #first look for the record not to exist in the DB to avoid duplicate records
        exist = Answers.objects.filter(name= request.user, teacher= user_pk ).exists()
        # if there is not then I proceed to create the record in the database
        if exist == False:
            for key, value in request.POST.items():
                if clave != 'csrfmiddlewaretoken':
                    Answers.objects.create(question=int(clave), answer_to_question=int(valor), student = request.user,teacher = int(user_pk)) 
            #then I change a record in the table of my DB where the finished evaluations are stored, from false to true.  
            actual_state= State.objects.get(student__name = request.user, teacher = user_pk)
            actual_state.finished_evaluation = True
            actual_state.save()
            return render(request,"myapp\send.html") 
        else:
            return render(request,"myapp\error.html") 

A:

Instead of worrying about the user changing the URL, I suggest that you add a check that the user is allowed to submit answers for that teacher.
For instance, if the Teacher model had a many-to-many field to User, then you could filter so that users could only submit answers for their teachers.
from django.contrib.auth.decorators import login_required
from django.shortcuts import get_object_or_404

@login_required
def send(request, user_pk):
    teacher = get_object_or_404(Teacher, students=request.user)
    exist = Answers.objects.filter(name= request.user, teacher=teacher).exists()

Note I've used the login_required decorator above so that you don't have to manually redirect users that are not logged-in.

