2

I've already read bunch of articles regarding the difference between http posts and http get methods. I'm just confused about which of the two is a better option in terms of security. Because, some article said that it is better to use post method rather than get because it did not allow the display of data in the url. But some also said that it is better to use get because it is not involved in updating of data, it is just there to read data and display them. So, which of the two should I choose? Or am I understanding this right? Please help, I need some clarification here... Thanks!

7
  • use http post, it is more seccure Jan 28, 2013 at 9:04
  • 1
    what's going on here and who's giving those negative rates and why? Jan 28, 2013 at 9:08
  • 1
    @VahidFarahmand: to be fair, most of the answers so far are rubbish (but I didn't down vote...) Jan 28, 2013 at 9:11
  • I don't even understand why others were down voting? I'm just asking your opinion guys. And thanks for those who answered.
    – nsutgio
    Jan 28, 2013 at 9:14
  • @nsutgio: down votes are typically used to express a belief that the answer is wrong or misleading. Jan 28, 2013 at 9:16

4 Answers 4

5

GET and POST are methods/verbs, and—as verbs do in spoken languages, and methods in programming languges—they indicate action. You should pick the method which best fits the operation.

Starting with the definitions:

GET

The GET method means retrieve whatever information (in the form of an entity) is identified by the Request-URI

POST

The POST method is used to request that the origin server accept the entity enclosed in the request as a new subordinate of the resource identified by the Request-URI in the Request-Line.

To generalize, a GET should retrieve, and a POST should create or update. The method chosen is unrelated to security; either can be properly secured or completely insecure.

To put it another way: Just because a POST appears to "hide" the data doesn't mean it is any more secure.

I suggest also reading about about REST principles.

I would further suggest reading about Idempotence and Safe methods. See § 9.1 of the spec for the direct application of idempotence and nullipotence to HTTP.

3
  • 3
    I would add this about security: without using SSL (https) both GET and POST can be intercepted and read (by a Man-In-The-Middle attack) making none of them more secure. (In case you use SSL) we could say that POST is safer because the requests won't be fully logged by your system (Apache or...) whereas GET requests would be written with all the args in the log file. So it means that if your server is attacked and the logs are read, ok, POST is safer. But I guess then you'd have other concerns.
    – maxdec
    Jan 28, 2013 at 9:13
  • @maxdec - I guess my point is that the accepted practice is to use the verbs which are appropriate for the operation, and then secure the application properly. But your point is definitely a valid consideration for achieving that security.
    – Tim M.
    Jan 28, 2013 at 9:15
  • 1
    @TimMedora: I completely agree. The names (POST, GET, UPDATE, ...) have been chosen to be meaningful.
    – maxdec
    Jan 28, 2013 at 9:29
0

POST or get is not really make difference in security, if your code is vulnerable to injections, POST or GET method would not make any difference or even you can say GET is more secure because GET URL will be logged entirely in log files and if there was an injection in your code, you can find entire injection code/part in log files, but POST data will not be logged.

POST doesn't have limit and support multipart posts, so you can use POST for uploading files etc. But GET parameter has 8000 char limit by default in apache.

POST will make your URLs look more clear and your parameters will be hidden.

0
0

POST and GET are two kind of HTTP Request methods that originally are used to POST (submit) data and GET (retrieve) data. This is heavily used by REST, together with more request methods (like PUT and DELETE). So that's the actual difference between POST and GET.

For forms on web pages, POST and GET are used as well. In terms of security, it doesn't really matter: Both can be read by the client. The only difference, is that with GET it's easier, since the user can view the parameters in the URL. With POST you'll need to fish the parameters out of the HTTP Request Body (More Details).

Bottomline: It mostly depends on what you want to do: Do you want the user to copy the URL to get the same page? For example, this might be useful:

http://www.yoursite.com/index.php?search=MySearchTerm

This is a GET request, which the user can copy/share with others. But a contact form would bet a POST request, since there wouldn't be any sense in adding all the contact details in the URL.

0
-1

Go through this you wil have a clear idea

Courtesy:-Wiki answers.....

$_POST and $_GET are both PHP variables used to extract input from HTML forms. However, the difference is that $_POST keeps the extracted variables hidden from users, whereas $_GET does not. Because of this, there is a major difference between the two variables in terms of security.

Why would you use $_GET at all, then? Because some websites have large databases full of information for the user. For example, say you were shopping online, and you go to buy 2 pairs of pants (item #125). The URL that you are sent to might look like this:

catalog.php?item=125&quantity=2

As you can see, the variables obtained through $_GET are visible to the user.

The POST method has possibility of much volume data sending (usually by the server settings limited) and it may be used unless it represents benefits in comparing GET method. A lot of browser can not correctly bookmark pages which are displayed after HTTP POST method, because the submitted data is displayed in the address bar. When you need the query string, which is get by GET method using (ineffective by it's limits), you will try to use POST method for your forms. You can use POST method if you submit the important information which shouldn't be displayed in the address bar.

3
  • Thanks for that. What about the tendency that in an online buying website a current user could be at risk of paying a multiple amount due to continues or unintended clicking of buy or submit button via post method? How would we prevent that?
    – nsutgio
    Jan 28, 2013 at 9:09
  • By the way, I'm not just referring this to PHP.
    – nsutgio
    Jan 28, 2013 at 9:11
  • @nsutgio dont you use Javascript/alert boxes for confirmation of the selection?
    – Php Geek
    Jan 28, 2013 at 9:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.