Hi -<BR>Quick question about server variables: Let&#039s say I have three pages, a login, a main page drawn up after a sucessfull login, and another utility page that can be used from the main page. Only those who are succesfully logged into the service may use the utility. Can I just have the utility page check the referencing URL as a security validation, assuming I only print the link to the utility for sucessfull &#039logers in&#039? Clearly I would like to avoid passing the login id and/or password, even as a hidden field, to the utility page. If possible, I&#039d like to say away from cookies also.<BR>How easy is it to fake a reference URL? Any thoughts or advice would be much appreciated.<BR><BR>Matt