Passing Query Sring security question

Is it safe from hacks to use query stings as a cross page post back to a database using forms authintication and membership & roles?   As I understand it, the only ones who can access the info are the ones authenticated.  Unless an unauthorized user is able to generate the username and password, which is secured with salt/hash, which makes the hacking username and password very difficult.  As long as an unauthorized user does not have username and password, then the unauthorized user will not be able to hack any info. from a logged in user?  Is this basically correct?
...