Can you not restrict this based on a user role or permission within the database itself? You can then give the restricted user details to the user CGI app and the other account to the staff program.

HTH

SP