oh ok, so for sensitive information best to use sessions then, are table Ids etc safe to throw in the GET var?
Yes, sensitive information must not leave your server in the first place. Use sessions.
As for “are table ids safe in the URL”: I don’t know, is there anything bad a user could do knowing a table id? If so, you need to fix that. Usually you need to pass some kind of id around though, whether that’s the “native table id” or some other random id you dream up usually doesn’t matter. There’s nothing inherently insecure about showing the id of a record in the URL, that by itself means absolutely nothing. It’s how your app uses this id that may or may not open up security holes.
Additionally think about whether a user can easily guess other ids he’s not supposed to know and whether that means anything bad for your security.
Security isn’t a one-off thing, you need to think about it in every single line of code you write.