Whilst posting about a scripting error in Zoho Creator, I just observed that apikey is passed naked in querystring. I believe this might be a security vulnerability. You may kindly resubstitute with an alternative risk mitigation strategy like forms or sessions.