You can use hidden fields, but that only hides things; it makes it only a little bit more difficult for a mischief maker to do bad things. A better solution is to encode the database query logic in a module or run state somewhere in the code, where users can't access it and you're not sending it to the client and trusting it to come back safely. CGI::Application is one good approach.