There is no such thing as preventing the user from "making changes" — this simply makes no sense; please see my comment to the question.
How you show you URIs is the different story. You have to show something. You don't have to show actual path though. Learn how to use URL re-writing and routing:
I hope this will be enough to do what you want.