Doesn't sound too fucked up IMO, as long as it is removed after payment is sent?
Speaking of hidden things in scripts, if anyone is using babelogger trying going to yoursite.com/msgs.php?msg=beatles (in IE)
http://www.13scripts.com/demos/babel...hp?msg=beatles