$POST Vs $_REQUIRE

jamie85

I have a page which has to display a picture, which has been clicked on from a previous page.

The previous page displays all the images in a directory, and displays them. When the user clicks an image, it takes them to a new page.

Would it be better to have the image in a form, and get the image name with $_POST in the next page, eg:

foreach ($files as $file)
{
	?>
	<form method="get" action="create.php">
	<img src="maps\<? echo"$file";?>" alt="<? echo"$file";?>" height="80" width="80"><br/>
	</label><input name="nameofmap" type="hidden" value="<? echo"$file";?>" />
	<input type="submit" name="mapuse" value="Use Map" />
	</form>
}

or would it be better to have the image name in the URI?

eg:

foreach ($files as $file)
{
	?>	

<a href="create.php?map=<? echo"$file"?>" ><img src="maps\<? echo"$file";?>" alt="<? echo"$file";?>" height="80" width="80"><br/></a>
<?
}

Are there any major advantages/disadvantages?

Thanks.

execute

form method="get" means GET request NOT POST.
form method="post" means POST request.

GET is only in URL and can be manipulated by hackers if you are not an experienced programmer. Otherwise use POST, which you need a form. With GET it can be a URL or a form with method="get".

You also do not need to use "$file" it can be just $file, without the quotes.
And also you should use <?php instead of short tag <? as it can cause problems in some servers.
And you should use $POST['files'] if you use POST or $GET['files'] dont use register Globals, meaning $files
However you can convert:
$files = $POST['files'];
$files = $GET['files'];

$_REQUEST is POST, GET, and COOKIE, it can receive all, so its rather unsafe.

PHP Anti-Hacking Tutorial

laserlight

It probably is more natural to go with a link rather than with a form, so that is what I would choose. Unless there is some chance that you might decide to go with a form using the POST method at some later date (upon which you should use $REQUEST for flexibility), you would then use the data from $GET, since the incoming data is passed via the GET method in your URI. If you decide to go with a form using the POST method instead of a link, and will not switch method, then you should just use $_POST.

$_REQUEST is POST, GET, and COOKIE, it can receive all, so its rather unsafe.

All incoming data is unsafe before validation, whether it comes from POST, GET or a cookie, or any combination of them.

execute

yes but REQUEST is more unsafe since you may just want the POST and someone can type something in URL that you would never think about, since you only wanted POST.

laserlight

you may just want the POST and someone can type something in URL that you would never think about, since you only wanted POST

Why cant they just type in something to your form, or even modify your form? If you perform adequate data validation, whether or not the data is sent via GET or POST makes no difference to your security.

_theworks

Just use links there wont be any vundrebilitys if

you perform adequate data validation

<?
echo '<ul>';

foreach ($files as $file) {
echo '<li><a href="displayimage.php?id='.$file->id.'" title="'.$file->caption.'">
	  <img src="thumbnails.php?id='.$files->id.'" alt="'.$file->caption.'"></a></li>';
};

echo '</ul>';
?>

ahundiak

From http://www.w3.org/TR/REC-html40/interact/forms.html#h-17.13

The "get" method should be used when the form is idempotent (i.e., causes no side-effects). Many database searches have no visible side-effects and make ideal applications for the "get" method.

If the service associated with the processing of a form causes side effects (for example, if the form modifies a database or subscription to a service), the "post" method should be used.

So use a link if all you are doing is displaying a picture. Use POST if a database is being updated. And, as laserlight has said, security is not really an issue since all incoming data needs to be checked.