To be honest, I think that the amount of pages on J2O that close the form tag are barely into the two digits.

Torkell, much thanks for your tips and even the prepared code . It's pretty much what I meant, and it looks good. I can't find any mention of a "hex" function in the php documentation, though. Looking at your code I'm not sure what it does, either. Is it needed when the md5 is already seeded with a secret word to avoid the possibility somebody may choose to encode things themselves? Urls should also support md5'd text properly, though it may be good to cut the string off at 8 or 16 chars or so to make urls shorter.