Using POST method to hide URL parameters

Question

I understand that I am able to use the POST method for URL parameters to display data according to a specific variable, I know how to make use of the GET method - but I am told that the POST method can be used to hide the part of the URL that is like this.

/data.php?parameter=1234

What is the actual difference of the two methods in terms of URL parameters?

Below is some code that fetches data from a database according to the id of a specific link

    <?php
//This includes the variables, adjusted within the 'config.php file' and the functions from the 'functions.php' - the config variables are adjusted prior to anything else.
require('configs/config.php');
require('configs/functions.php');

    //This is the actual interaction with the database, according to the id.
    $query = mysql_query("SELECT * FROM table WHERE id=" .$_GET['id'] . ";") or die("An error has occurred");

            //This re-directs to an error page the user preventing them from viewing the page if there are no rows with data equal to the query.
    if( mysql_num_rows($query) < 1 )
{
  header('Location: 404.php');
  exit;
}

    //Here each cell in the database is fetched and assigned a variable.
    while($row = mysql_fetch_array($query))
    {
        $id = $row['id'];
        $title = $row['title'];
        $month = $row['month'];
        $day = $row['day'];
        $photo = $row['photo'];
        $text = $row['text'];    
    }
?>

On a separate page I generate links to the data.php file according to the ID like so:

<a href="post.php?id=<?php echo $content['id']; ?>"><?php echo $content['title']; ?></a>

Forgetting that there are potential SQL injections that can occur through the above code, how would I go about making use of the POST method in order to hide the URL parameters, or at least not display them like this:

http://example.com/data.php?id=1

Answer 1

In order to use POST, you will need to use a <form> tag, and depending on how you are pulling up these URLs, it could be easier to use javascript to help out. Here's a basic example:

<form method="post" action="data.php">
    <input type="hidden" name="parameter" value="1234" />
    <input type="submit" value="Go" />
</form>

The Go button would POST the form data, and now in data.php you will be able to retrieve the value from $_POST['parameter']. Note that when using POST, you will probably want to redirect (HTTP 302) back to a page so that when a user hits the back button, the browser doesn't prompt to resubmit the form.

Using javascript, you could set the parameter input to a different value before posting the form.

Answer 2

Use method "POST" for your form. I had the same issue, just adding POST to the form removed the parameters from the URL

<form id="abc" name="abc" action="someaction.php" method="post">
    <input type="text" id="username" name="username"/>
    <input type="password" id="password" name="password"/>
    <input type="submit" id="submit" name="submit" value="submit"/>
</form>

Answer 3

To POST values, a browser would have to use a form with method="post", or javascript simulating a form. Various developer tools (fireug, etc) can convert GET forms to POST forms, but generally, a form is what is required.

In theory GET requests should not have any side effects, and "should" be consistent from request to request. That is, the server should return the same content. In todays world of just about everything being dynamic, this might be of little practical design significance.

Answer 4

Whether you use GET or POST, the parameters will appear in $_REQUEST. The critical difference is that using POST allows the variables NOT to appear in URL history. This decreases the visibility of data such as passwords which you do not want to show up in URL history. To use POST instead of GET, simply produce <form method="POST" ...> in the document.

Even better is to store sensitive values (like user ids) in cookies, so that they don't appear in $_REQUEST at all. Since the contents of cookies are provided in extra HTTP request headers, not in the content, they are generally not stored as part of the history.

Answer 5

In order to use POST instead of GET, you would need to use an HTML form tag in your html, like so:

<form method="POST" action="/data.php">
  <input type="hidden" name="parameter" value="1234" />
  <button type="submit">Submit</button>
</form>

When submitted, your URL will just be /data.php and parameter=1234 will be in your (hidden) post buffer.

Make sense?

Answer 6

To do a POST, you have to use a form, or some javascript/ajax trickery. An <a> will only ever cause a GET request.

Note that POST requests can still have query parameters in the URL. It's not "normal" to have them, but they are allowed. The main difference being that with a GET request (ignoring cookies), the URL is the ONLY way to send parameters/data to the server. With POST, you can use both the URL, and the body of the POST request, which is where POSTed form data is normally placed.