While he doesn't look very convincing, that's not exactly true. He could store them in a cookie (he clears cookies at the start), localStorage, sessionStorage, ... in the submit handler from JS. And what tells you he doesn't use PHP or something similar :)? It's not because the URL ends with...