help as soon as possible

A URL with a query string is shown because the ID is being sent as a GET parameter. There are a few practical ways to avoid the raw P_id appearing in the address bar; pick the one that fits your app and security needs.

• Use POST: submit the ID with a form (or an AJAX POST) so it arrives in $_POST instead of the URL. That keeps the value out of the address bar and browser history. See PHP $_POST.
• Use server-side state: store the target ID in the session (session_start() + $_SESSION) or in a short-lived server-side mapping (a one-time token) and open the edit page without the ID. See PHP sessions.
• Use a small handler/redirect: POST to a handler that records the ID server-side and redirects to edit.php without the parameter (or with a non-revealing token). This avoids exposing the raw ID but still uses normal navigation.
• Pretty URLs: URL rewriting (mod_rewrite) can move the ID into the path (e.g., /edit/123) but note the value is still visible as part of the URL. See mod_rewrite.

Security notes: hiding an ID is not access control. Always validate and authorize on the server, escape outputs, and protect against CSRF. As @vicky_rawat suggested, confirm where your record ID is being sourced and sanitized; and as @ShantiC noted, double-check the database query logic. For high-level guidance on secure handling, consult the OWASP recommendations (OWASP Top Ten).