NYCPHP Meetup

[csnyder]

On 11/21/05, Michael Sims <jellicle at gmail.com> wrote:
>
> While the RFC's are all well and good, the real reason for not deleting
> items from your database via a simple hyperlink click is that sooner or
> later, one of your users is going to install a Firefox extension that
> promises to speed up web-browsing by pre-caching everything.  They're
> going to visit your page with that extension installed, and the Firefox
> extension is going to delete their whole database by auto-loading all the
> page links.  And who are they going to blame?  You.  Yes.  You can see it,
> can't you?  The client calling in apoplectic rage?  The sinking feeling in
> your stomach?
>
> That's why you "make things happen" with POST instead of GET wherever
> possible...
>
> Michael Sims

Exactly.

And I'm sure it's already been pointed out that some loser could post
an image on a website somewhere whose src attribute is a URL that
includes the GET vars needed to modify data in your app. There's a
million scenarios (some more likely than others, of course) in which
allowing *important* changes to data based on GET is a really bad
idea.

Not that you can't trick someone into inadvertantly POSTing data (as
with a search form) but at least the user has to take some action for
this to happen.

--
Chris Snyder
http://chxo.com/