The performance shouldn't be the bottleneck for small databases with slightly load.
You can use the integer p.k. :
I think it's not a problem giving the integerid for authorized persons. But securing it with a secret-code, the id and a following hashcode should be sufficient
f.e.
product.php?id=7&hash=a78e9809....
creating $hash with md5($id."secret") and
comparing the code in the header of your script with the production of the encryption function