Where's the cheese? --#-- Now it's time to examine the source some more. Could the missing data be hidden in the cookie? It might be, but it's not. You can try sending the cookie (add a Cookie: line to the header you send and paste in the cookie string sent by BK. Won't do much good, though. The cookie is probably just a session ID, so Burger King can count the number of unique visitors to its site.

What about those hidden fields just under the <form> tag?


Another funky twist to the HTTP POST: Check out the JavaScript in the HTML header.


If you study it, you'll see that it's mapping the value of the <SELECT NAME=so> field to a field of si and the value of the <SELECT NAME=sc> field to a field of ac.

If you want, try to figure out how this works by performing the JavaScript translations on paper, and using the hidden fields. I tried myself for quite a bit of time, before I hit on a trick solution using yet another Java gadget.