I don't know Mason, so I'll only address the second question. You can't give data to the client without the user being able to have access to it.

That said, "removecard" suggests you at doing something serious on the server, so you should be using POST not GET, and that mean you need a form, not a link. (Using links risks bots and precaching engines deleting things!)

If you use POST then the data will not be visible in the URL, although the user can still access if if they want.

One: this doesn't work

two: I don't want people to be able to see $card_id in the url

three: it's not pretty

# sample of href from CGI.pm

use strict;
use diagnostics;
use CGI qw(:standard);

my $id = CGI::escape(param('id'));

print a({-href=>"removecard?card_id=$id"}, "Remove");
[download]

Here we loaded the CGI module with standard HTML functions and then assigned the variable $id to the posted variable for the id of the card the person wants to retrieve. (This would be sent to your script by a form or a query string and retrieved through the param() function)

Then we make sure the id will not create a malformed URL by using the CGI::escape() function to convert any characters to their hexadecimal equivalents.

Once this is done we are ready to create the HTML itself. This is done by printing out the return value from the a function, which creates the same HTML as an tag would. The link attributes are sent inside curly braces {} and are defined by the '-href' attribute. The value for the link is enclosed in double quotes ("") so that the $id variable will be interpolated by PERL and create the link to the card.

The last part of the a() function is the text displayed for the link on the page.

A more complete version of this script would need to create the starting and ending HTML and the neccessary header.

For a good general reference on CGI.pm I would suggest the modules manual page at CPAN: http://search.cpan.org/~lds/CGI.pm-3.27/CGI.pm

I don't want people to be able to see $card_id in the url

Is it the actual value of $card_id you don't want them to see, or the name of the parameter?

As has been suggested, a form withh a POST request is a good way to avoid ugly urls like this, but the param names and values will be available to the client.

I want to create a link to a mason script and pass it a value:

I don't know what you mean by 'Mason script', do you mean a 'component'? Does this component exist? Does it contain the <%args>$card_id</%args> declaration?

But, if you want to use a link, you have an option in Mason that may work depending on your site architecture etc.

Use a dhandler in a directory for removecard then pass the card_id on the url and get at it with $m->dhandler_arg. Giving you an url like <a href="removecard/<% $card_id %>">remove</a>

This of course still puts the value of $card_id visible to the user, in the url, but "what" that id is is not identified.

I played with mason for a bit, are you allowing mason to cache the templates? if you are, you'll need to restart apache each time you change them ... (sadly the option's name escapes me)

Why not just move the whole link off into another component?

<& /bits/link, action => remove, card => $cardid &>
[download]

Then you can mess about whith the widget without having to worry about how complicated or ugly the markup is because you're including another component. Then you can even change it into a form POST later on.

Update: added & and >'s to make valid HTML::Mason