what GDS said,

Although I won't be as critical as saying that it would only take five minutes, but that's just calling a sql deletion request on item's type for the demanding player ID in the PlayerXItem table. In fact such a function would relieve the server from having to make the dozen of selections required by an autoclicker or a stubborn player deleting stacks of items.

That unique ID thing is irrelevant as to security, it's the server that ultimately decides what can be done or not, the client only makes "requests".