If you're passing it through the GET method (query string on url), it will always show up unless you encrypt/encode it somehow.
A good alternative way would be to POST the info to update-delete.php instead.
Ex:
<form action="update-delete.php" method=POST>
<input type=hidden name=username value="<? echo $username ?>">
<input type=hidden name=REFERED value="<? echo $REFERED ?>">
<input TYPE="image" SRC="path/to/image/submitimage.gif"
NAME="imagesubmit1" ALIGN="top" HEIGHT=50 WIDTH=50>
</form>
I know it's longer, but it will work for what you're trying to do.