POST or GET: Which Method to Use?
--------------------------------------------------------------------------------
Okay so u have a form and a preprocessor(i mean PHP). Now you're wondering what method to use to process the form....
GET or POST
First of all let's see the difference. In GET, the contents of the Form are sent in the url
eg. If you are using a file process.php which accepts the fields name, email, class, etc and does something with them. Then on submitting the form, the browser will open this URL:
http://someurl.com/process.php?name=...ail=someemail& class=XYZ
but in case of post, it sends an intrinsic array, which is not visible to the user(like get is).
So you should use Post when either the data is too complicated...Imagine a 3 line paragraph in your browser url
or you need security....
Why POST is secure?
Obviously because the information is sent intrinsically. However this doesn't mean that it is secure from pro-hackers etc. Its secure compared to GET.....
Another reason is that you don't quite require a Form to be filled up when using get
A simple img tag is enough to send the data
In the previous case, the script can be provoked using
<img src="
http://someurl.com/process.php?name=Som ... =someemail& class=XYZ"/>
This will not show any image but will do the job anyways. But in post this is not possible,
The problem with get becomes significant if you have a big thing
Suppose the file sendmessage is used by the user to send message a friend(in a social networking environment)
it works with friendid and messageas parameter(
http://somesite.com/sendmessage.php?...120&message=hi)
but now an unscrupulous site puts up an image on its site
<img src="
http://somesite.com/sendmessage.php?fri ... You%20bloo dy%20*****%20Get%20Lost>
Theuser while logged on into ur site also visits this site.
He will unintentionally send a message to this user....
so this is where u need post..
Should you always use post....?
No not quite. Depends on you requirement. If the action performed is something that doesn't make much of a difference in the site or user's life,
go on
A profile page will have to use get
[noparse](
http://someurl.com/profile.php?user=..)
Otherwise users cannot give out their profile links....
or even a refferal url(
http://someurl.com/?ref=idsadas)
which is again given out by people