I believe that when the values are passed via the URL, the are saved into the $_SESSION (memory), but not actually saved to the database until after you pass the page on which those hidden questions are present.

If you navigate far enough into the survey that you pass the page with your hidden questions, do you then see the URL parameters in the database?

The hidden questions are actually on the first page (first group) of the survey. When the questions are visible, they are the first thing you see when you enter the survey. It is after I complete the survey that I look in the database and all of the survey answers are there except the hidden questions. When they are visible, even if I don't touch them, they save to the database correctly.

I read somewhere that hidden fields are not actually built into the page displaying the survey which makes me wonder if they are not being posted when the survey submits.

Do you see <input type='hidden' id='SGQA'> fields created on the first page for your hidden variables? If not, then the hidden values would not be posted. However, that shouldn't matter, since the decision about what to save to the database isn't entirely based upon what is posted.

Please attach the .lss survey file (or that first page group) so we can test this.

I do not see hidden input fields for the hidden questions.

OK, there are couple of possible ways to deal with this:

(1) At survey launch, save all URL parameters to $_SESSION, and then only save the actual values to the database if the questions are relevant. The question is when to save to the database:
(a) Just before visiting the page on which they are declared (as default values are saved now)
(b) Save only after visiting the page on which they are declared (e.g. if press next, previous, or resume later).

(2) At survey launch, save all parameters passed via URL to the database (e.g. first ensuring that they are survey-specific variables with valid SGQA codes). But, should they be validated in any way first? Certainly, they should be processed to ensure that unsafe or data-type mismatched values aren't stored. However, in order to ensure that they pass relevance and validation criteria, you need to either
(a) wait until the page where there are declared (since validations occur there);
(b) validate the whole survey (which can take a couple of seconds); or
(c) do a loop to validate each question associated with the SGQA codes - but this isn't as thorough a validation since it is taking the questions out of the larger context.

Saving the URL parameters at the start ensures that you don't lose the context if the person stops mid-survey and wants to come back later (without using the full URL again).

However, saving all URL parameters at the start without strong validation runs the risk of having some invalid or irrelevant data saved early on. This will be cleaned up as the survey progresses, and the survey will be fully clean by the final submit. So, is having a partially inconsistent data row considered a problem?

Saving to the $_SESSION is fine as a first step - if the first values from a normal survey page are submittted/saved to the database the URL parameters should be saved to the database, too.

In the Yii version you will not be able to the old style SGQA in URL parameters anymore.

Instead you can create your own URL custom variable names and specify in which question they should be saved.

So, I'll implement option (2)(d) - put all URL parameters into $_SESSION, and save them to the database (after minimal validation), when the first page is visited.

Fixed in revision https://github.com/LimeSurvey/LimeSurvey/commit/2bcbd199bb74dc95e4a01209e72835b5dcd00169

1.92RC5 release