There is no way to protect that.
Any data you send to a browser can be changed. The trick is to make it so that it doesn't matter wether they change it.
a rule of thumb is: never send anything that you don't have to send.
You can use sessions to store data on the server-side instead of sending it through the URL all the time.