It makes sense that the second script would be able to get the user id from the remote_user() since it is handled by the server. However could you please explain what a less dangerous way to pass 2 variables to a different script would be. I am not understanding how the hidden form element works.