method=post only works for input types, not text links (IIRC). I've had the same problem as the original poster and had to create a text link (ie: a table of files to download) that has to include the username/password. IMHO, looking at the answers presented by the monks is to go with cookies. It's a bit more of a pain than putting it in the string, but it'll prevent figuring out passwords. Regards