"AFAIK any database locks should be released when the connection ends (or as soon as the DBMS gets around to releasing them). "
Database locks yes, like when you do a 'SELECT FOR UPDATE" etc.
But in a web-environment you select records, print them in an HTML form, and then you disconnect from the database server, which would release the lock....
"What you are thinking about will work, but make absolutely sure you will release the lock if the user just goes away (maybe a timestamp instead of a 0/1 flag)..."
This is why I suggested using both a userid and a timestamp, so you can identify who locked the record, and when it happened.
Also, releasing the lock 'when the user goes away' can be replaced by "when another user wants to access a record who'se lock has expired"