You COULD use a store/forward technique. Here is a rough pseudo what it would look like:
IFRAME POSTS
Grab vairables and then place them in a temp SESSION variable. You could even do a comma separted list such as $var1;$var2;$var3; that way you only use one session variable instead of a billion. :-D
Then run this:
<SCRIPT LANGUAGE="JAVASCRIPT" TYPE="TEXT/JAVASCRIPT">
<!-- Hide script from old browsers
// End hiding script from old browsers -->
parent.top.location.href='http://www.google.com';
</SCRIPT>
That will bounce them to google.com but place your site in there. Then look for the temp session variable and run this if found:
$posted_array = explode(";",$GLOBAL_SESSION_VARIABLE_NAME);
$var1 = $posted_array[0];
$var2 = $posted_array[1];
$var3 = $posted_array[2];
That SHOULD return all the data they sent without using a method that will show the user what data was placed in the iframe. I have NOT tried this, I am pretty sure that it will work but just incase it doesn't you can't say you weren't warned. haha, I have learned my lesson on here when things don't work.
Take care and have a good one,
Chad R. Smith