Help Please!

Hello everyone! I need some help convincing the people above me on a certain issue because I'm lead to believe that they are going about it in the wrong manner. Here is the issue, we are using PHP4 session handling for a huge website which has 500,000 customers. We are expecting about 30% of these customers to actually do business through this website and of course have the base customers grow as well. At any rate, what they are wanting to do is put the primary keys for users accounts encrypted using the Blowfish algorithm with two modifications on it and then putting the encrypted information in the url along with the session id. My big complaint is that you are going to have to encrypt and decrypt the user's information on every page of the application, in turn using a ton of cpu power. The only reason why they are going to be using sessions is to keep each user unique. We run a huge Oracle database and I have suggested to put all the session information into that database and avoid using the encryption / decryption. However, they do not want to put any more hits on the database than possible because at some points of the day it becomes a little sluggish. Since I'm not a dba is it safe to assume that making the session handling via oracle wouldn't bog it down anymore than it already is? I'm just trying to avoid having to write this encryption and decryption code that I know is going to slow the site down when we could just put the information into oracle and it would be safe and secure. Am I correct in assuming all of this? From what I have read I feel that this is a safe bet and is used all over the web. Anyway, any comments/seggestions on this matter is more than welcome! Thanks, Jay Paulson