This is almost exactly the idea that I have been playing with. I was however hoping for a method that would avoid picking an "arbitrary" string. I too believe that, given a sufficiently "weird" string, this method is unlikely to cause a false positive on the encryption question.

As a note: I actually have written an extension to CGI.pm to make the param() method perform the decryption where appropriate. That means the coders do not have to alter anything to decrypt() the information.

Thank you all for your suggestions.