I have a site that allows user A to search for and view other users.
When user A clicks on say user B. I pass user B's id as a GET variable. I then use that id inside my view to display the appropriate data. Is this good practice? Should I expose a users ID?

Also, when user A is on user B's profile he can send user A a message. How do I pass user B's id securely to my controller?

Any help greatly appreciated.