I assume they're logging in to some sort of admin area.
I would use their unique session ID (that was created at login) and filter the recordset of properties with that.
This way they only get their own properties and you don't have to use a parameter in the url.