Passing variables vs session variable

what is the advantage of passing the variable in the url vs storing the variable in a session variable and retrieving it in the second webpage you are accessing?

The variable that you will pass using the QueryString will be visible to the user hence not secured. The value that you put in the Session is not available to the user as it is on the server side and hence more secured.

performance wise does it matter?

Just my 2 cents...

I remember in college the professors would always harp upon using the Session responsibly. Most of the professors were older and came from backgrounds where memory was used sparingly. So, if you were cramming loads of data into the Session (back in the day), you'd maybe begin to experience some bad effects because of it. Accordingly it was advised to use the Session sparingly.

However, it seems to me that things have changed a little. We have more memory and it's faster than ever; the average joe-blow user has more bandwidth than ever. Consequently I don't think people worry about using the Session too much as much.

Yes, performance wise, session variables take up memory on the server so using too many sessions can affect the overall performance of the site. I use them a lot and haven't seen too much of a performance issue, you must have to use a lot of them to affect memory. Or maybe sticking arrays into sessions would start to affect things. Good luck, Mike

there are a few ways of passing variables around:

Single page Postbacks:

1) Use ViewState. It's simple, encrypted. Only problem is too much will slow the clients computer down

2) Use hidden <asp:labels />. Pretty much the same approach as the veiw state.

Navigating from page-> page

1) Query String. Yea, they might see some ID's at the top.

2) you can "Submit" to a new page with ASP.NET 2.0, which allows you to use values from your original page.

3) You can use session. But I would advise against it. Session variables should be used to house things that are important for the user, like: ID, UserName, etc. I would never want to see a dataTable, Array, etc. stored in the session.