setting up public facing visual force, but need to direct email recipients appropriately

Question

I'm taking a whack at Visualforce, and am hoping to avoid too much Apex, but maybe this isn't possible. Basically I'd like to direct some 300 recipients of an email to pages that are relevant to their respective data sets, so that they can review/edit/approve them. I've set up a Visualforce page that works great inside the platform when I populate a URL manually with a record ID. And I've succeeded in making this VF page publicly accessible, handling permissions for the page, the referenced objects, and the guest user profile. But I can't figure out how to direct an email recipient to the public facing page AND pass the appropriate ID through the site page through to the VF, and get the VF to pick it up and render the appropriate info. Maybe this is more of a developer question, but thought I'd take a shot. Here's my VF

From what I can gather, I may need to create some kind of controller extension to the standard controller that can pick up the relevant variable. The shtick on VF and Sites (we are on Enterpirse) is all about making your data accessible to the public, but it's turning out a bit harder than advertised. Thanks in advance

Answer 1

from Christian Carter at Big Boat consulting (I've tried his suggestion successfully)

As you've noticed, when you're using the standard controller, you can just pass an id in the query string, and everything will work out the way you expect. So your problem isn't really in the visualforce, it's in getting them to the page!

Presumably you have your site set up like https://supercoolnpo.secure.force.com/ourgreatsite/myvisualforcepage -- so in your email to your recipients -- you just need to add a merge field! If you're emailing Contacts, I'm going to assume you have a lookup to the appropriate Practice Audit on their record. Then your email merge should look something like:

Click here to edit your data.

Now, one thing that's really important here -- you have effectively removed ALL security from that object. Salesforce IDs are assigned roughly sequentially, so any of your users would be able to start guessing IDs of other records and editing/approving them. This is generally not acceptable. If that idea scares you, you'll need to look at Communities or another authenticated user option. by Christian Carter