Key Mapping / URL hiding etc

Question

Hi All APex Fans,
I'm in the process fo deploying a public application . ( i.e. zero authentication)
My URL is a typical HTMLDB URL which reveals certain key fields depending on which page of the application you are :
https://xx.xx.xx/htmldb/production/f?pp=xxx:2:1276630965096638381::NO::P2_USERTYPE,P2_USERID:employee,E0999
In other words , Managers are horrified by the fact that this URL reveals a bunch of key fields and information .
I can hide the first part using virtual host - but How do I create "key mappings" for the rest of the URL that starts with ?p=.....
Is there such a thing called Key Mapping available for HTMLDB ? ( similar to what we have in Oracle Reports)
Or is it much preferable to use Frames ( where the main frame stays static to the main URL and the Window frames play the HTML DB application pages without revealing HTMLDB URLS ?
Could be a dumb question - but I am also being a mouth piece to some Oracle Reports experts who feel very strongly about HTMLDB URLS which they said reveal too much of its key info.
Any suggestions ?
Indira

Answer 1

Only pass the items that you need to (for example primary keys of records you wish to manipulate). Most other item values can actually be set in the page itself.REPLY : That's exactly what I do / did.
typically , the USERID does not show on any page at all- it only shows up IF and only IF i open a "drill-down" pop-up in a new window from a main page that brances to it using a USERID.
- pop-ups typically don't show URLS. I know.
But I was only playing both good and devil's advocate to explain my anti-SQL-Injection strategy . I was trying to explain how I made sure "malicious users" won't be able to play with URL to reveal confidential info because I have other checks in the SQL code to block confidentation info, even if the user=USERID is displayed if that USERID is set from the browser.
Unfortunately , I had to show them how you could substitute portions of the pop-up URL , for the actual URL and play with URL.
( I won't say I have shot myself in the foot) - But now the users are expressing general concerns about setting this USERID from the browser.
Who said DBA's and developers only struggle with machines ... ? It's complicated for users to understand .
Are your managers horrified because they can see the information? Or are >>they horrified because they believe that if they can see it then it must be insecure? REPLY :: Yes - they horrified because they believe that if they can *see
I think the use of FRAMES can definitely soothe the climate because the blanket/main FRAME will always show a lovely https://xxx.xxx.com/myapp/
no matter which page of the application you are in.
Due Dilligence .
Any other ideas ?
Regards...