Any value that you use to look up user information to populate a template is going to expose some information about how your application works, whether it's inc

Any value that you use to look up user information to populate a template is going to expose some information about how your application works, whether it's incremental or a GUID or a hash. There is some value in not having it be incremental in that it's not as easily fuzzable, but spidering the site will still cough up a bunch of valid values for the 'userid' parameter. Even if the form field is hidden. What are you writing, anyway?