Should I be able to delete anyone's database?

1) If someone has a 'Link' field, it truncates the data after a certain number of characters. It then displays '...' in place of the truncated characters, but also truncates the actual URL for the link. Yikes.

2) If someone is logged in and is administering a database, and clicks on a link to a site, if we follow the referrer, we are able to administer the database. Yikes.