Re: Separating GET and POST parameters

Kwindla Hultman Kramer <[email protected]> wrote:
> Jeremy Morton writes:
>  > No way.  I think there's some reasonable arguments for seperating
>  them out; > they are designed for different purposes.
>  >
>  > Examples:
>  > I might want to prevent someone from submitting their password via
>  GET (less > secure).
>  > I might want to prevent someone from submitting binary data via
>  GET (very > likely to be invalid).
>  > I might want to prevent someone from submitting a repeatable query
>  (say, to > a search engine) via POST (not bookmarkable).
>
> Generally speaking, the three example scenarios above can all be
> handled by simply rejecting requests of the wrong type. Something
> like:
>
> <%init>
>   if ( $r->method ne 'POST' ) {
>     $m->redirect ( 'complain_about_method' );
>   }
> </%init>
>
> I agree with Jon's argument that conceptual simplicity, ease of
> maintenance, and portability all argue for treating GET and POST
> arguments in the same way at the framework level.

I have a fundamental difference of opinion with you.  Why is the 
specification designed so that both GET and POST params are allowed to be 
submitted in one go if they are meant to be treated equally?

As for testing for the type of request method, that won't always work as you 
partially pointed out in your reply.  However, you suggested that a system 
would have to be designed a certain way for a POSTed request to contain 
important parameters that were sent via GET; not so.  One can imagine a 
scenario where somebody simply sets up a form to POST to a URL, but appends 
?mypass=ANCDD&bindata=hahabonk to it; the script sees the request as POSTed 
but doesn't realise important parameters have been specified via GET, unless 
the two are seperated.  This form may even *also* have these parameters 
POSTed (I can't remember whether that's possible, I believe it is) - in any 
case, you'd want to check that $post(param) was true and $get(param) was 
false; simply testing the request method isn't good enough.

Best regards,
Jeremy Morton (Jez) 



-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click