Why NOT use POST method here?

Question

I have a classifieds website.

In the main page (index) I have several form fields which the user may or may not fill in, in order to specify a detailed search of classifieds.

Ex:

   Category: Cars
   Price from: 3000
   Price to:   10000
   Color: Red
   Area: California

The forms' action is set to a php page:

   <form action='query_sql.php' method='post'>

In query_sql.php I fetch the variables like this:

   category=$_POST['category'];
   etc etc...

Then query MySql:

   $query="SELECT........WHERE category='$category' etc etc....
   $results = mysql_query($query);

Then I simply display the results of the query to the user by creating a table which is filled in dynamically depending on the results set.

However, according to an answer by Col. Shrapnel in my previous Q I shouldn't use POST here: How to hide URL from users when submitting this form?

The reason I use post is simply to hide the "one-page-word-document" long URL in the browsers adress bar.

I am very confused, is it okay to use POST or not?

It is working fine both when I use GET or POST now... And it is already on a production server...

Btw, in the linked question, I wasn't referring to make URL invisible (or hide it) I just wanted it too look better (which I have accomplished with mod_rewrite).

UPDATE:

If I use GET, then how should I make the url better looking (beautiful)? Check this previous Q out:

How to make this very long url appear short?

You should use parameterized queries or, at least, string escape the inputs. It would be trivial to craft a request that would compromise your database with the code you've shown. — tvanfosson, Jun 09 '10 at 11:57
Another way to have a short url (but not SEO) is to do a POST, save the search filters in a DB table, getting the id of the inserted record then redirect to a page like search.php?searchid=123456 which executes the search. This way you can have a short url while having many parameters. Beware of the structure of the table if you change which fields are searched. — Keeper, Jun 09 '10 at 12:02
the whole chain of ignorant questions from one overupvoted ignorant answer. Welcome to SO — Your Common Sense, Jun 09 '10 at 12:16
Sure, you can make the URL beautiful. So beautiful that no search engine will ever find it and no human will be able to share it. — Lotus Notes, Jun 09 '10 at 17:41

score 12 · Accepted Answer · answered Jun 09 '10 at 11:54

12

Search engines won't index the results
People can't bookmark searches
People can't send a link to their searches to their friends
People can't link to results page from their own webpages
Some people can't go Back to the page without receiving scary "Do you want to resubmit the form?"

If I use GET, then how should I make the url better looking (beautiful)?

You shouldn't. It doesn't matter. The number of users who would notice the URL the form submitted to is tiny, and the number who care is even smaller.

answered Jun 09 '10 at 11:54

Quentin

914,110
126
1,211
1,335

@Camran re your update, I would say that's a different question. – Pekka Jun 09 '10 at 12:00
But you say search engines ignore POST urls, they also ignore urls which are long and ugly, like q=938&b=alskda&c=835983jdla&d=9284 etc... So I think in my case this wont matter, then only thing I haven't tested yet is the refresh button or the back button, because I would hate it if the "Do you want to resubmit the form" came up... – Jun 09 '10 at 12:01
if you want to beautify the url after the question mark you need to use Javascript to create a beautiful url from your form field values. But I would advise against this, because search engines don't understand javascript. And it should be no problem to use an *ugly* url for search results (almost every website does it like this). To shorten your url you can shorten your field names if possible – jigfox Jun 09 '10 at 12:02
2

Who says search engines ignore URLs that are long and ugly? – Pekka Jun 09 '10 at 12:03
If you have a lot of options then it is entirely possible that search engines won't index the content … but that's one consideration out of five. – Quentin Jun 09 '10 at 12:04
What if I have a sitemap which is updated regularly, and where I have the rewritten URLS to the classifieds in? Would search engines go through this sitemap regularly and index the classifieds that way then? – Jun 09 '10 at 12:06
2

who says search engines fill search forms? – Your Common Sense Jun 09 '10 at 12:14
People fill search forms, then copy/paste URIs into webpages, which search engines index. – Quentin Jun 09 '10 at 12:17
David, please answer if a Sitemap would be of choice here? I believe that would solve my prob, but need confirmation on this. What do you think? – Jun 09 '10 at 12:20
@Camran - re. sitemap - yes, it would. You just need a page which links to every possible search page that you want indexed. – Sripathi Krishnan Jun 09 '10 at 12:23
@David got an example? and what are these people in the context of search engines at all? – Your Common Sense Jun 09 '10 at 12:28
An example of what? People copy/pasting URLs into webpages? Such as http://www.google.co.uk/search?q=people%20pasting%20urls%20into%20web%20pages ? Search engines don't submit forms, they do follow links. A URL is a URL, it doesn't matter if it is used in a link or generated by a form, it still goes to the same place. – Quentin Jun 09 '10 at 14:53

Pekka · Answer 2 · 2010-06-09T12:02:03.753

1

The idea behind using GET over POST is that using GET, you have a search URL that you can modify in the address bar, bookmark, and pass on.

Technically, both methods are fine ~~and basically interchangeable~~ if you have no need to address these aspects, and are passing data from one page to the next.

One big difference between GET and POST is that GET parameters shouldn't exceed 1-2 kilobytes in size. The size limit for POST request is usually in the dozens of megabytes.

edited Jun 09 '10 at 12:02

answered Jun 09 '10 at 11:55

Pekka

442,112
142
972
1,088

There's one big difference: GET requests are supposed to be idempotent (per the standard). Not that this is always respected... (e.g. "click the link to validate your e-mail") – Artefacto Jun 09 '10 at 11:58

score 1 · Answer 3 · answered Jun 09 '10 at 11:58

1

You probably want to perform some vetting on the user inputs to mitigate against SQL injection attacks as it looks like the input is directly manipulating the SQL statement

answered Jun 09 '10 at 11:58

dan richardson

3,871
4
31
38

Rich Adams · Answer 4 · 2010-06-09T12:51:30.687

GET should be used for requests which are either read-only or don't have any side-effects on the data (i.e. they should be idempotent, as mentioned in the HTTP documentation). You should be able to submit a GET request as many times as you want without it affecting what results will be returned. (You may not always get the same result though, since something else may have changed in the meantime of course, but the GET request shouldn't change the data itself).

So searching comes under this category, since you shouldn't be changing any data on your system which will affect the output when you search, you're just giving data to the user based on some parameter they're giving you.

Of course some data you will always want to be updated, such as statistics (as mentioned in the comments), and this is fine with GET, as it won't affect the response, it's just to keep a record of all the requests made, etc.

POST should be used when any destructive action is performed (by destructive, I mean when data is changed.. not just delete). So add, update, delete, etc.

This is why a browser will usually prompt you if you want to resubmit a POST request, but not for GET. It's because POST is meant to be used when data is going to be changed.

Also, some browsers can pre-fetch the pages from links on your page (to try and give the illusion of speed when a link is eventually clicked). If the GET action does something destructive (such as delete a record), then this could be inadvertently triggered simply by visiting the page the link is on for example.

If you're worried about your URLs looking "messy", you can use something like mod_rewrite to make the URLs more human friendly. So "http://yoursite.com/search/cars/red" could map to "http://yoursite.com/search.php?category=cars&color=red" for example.

The likelihood is that search WILL change data on your system. Stastistics are important. Also, just because an operation doesn't change a system isn't cause to call it idempotent. Idempotents get the same result for the same input, search might not despite not having changed the system. OTOH I agree that search should use GET — Matt Ellen, Jun 09 '10 at 12:18
Idempotence doesn't necessarily mean that the same input = same result. It means that if you give the same input multiple times, it won't have any side effects on the result (but the result could be different if something else has updated the data). So statistics are fine since they won't affect the output and you'll want to collect them for every request anyway. I have updated my answer to try and make this a bit clearer, although I fear I've just made it more confusing :) — Rich Adams, Jun 09 '10 at 12:49

score 0 · Answer 5 · answered Jun 09 '10 at 11:57

0

First of all remember to sanitize your input using mysql_real_escape_string. GET vs POST is practically the same except that:

With POST you can't bookmark the page
With GET you can't post files and there's a length limit on the query string

I use POST only when I know that the page will modify something server side (i.e. DB update) and then do a redirect to another page.

answered Jun 09 '10 at 11:57

Keeper

3,516
1
18
29

There's a limit on GET request as well: http://stackoverflow.com/questions/266322/http-uri-get-limit – Alsciende Jun 09 '10 at 13:27

score 0 · Answer 6 · answered Jun 09 '10 at 11:59

0

David Dorward's answer addresses most of the points - however a big one he misses out is the issue of cacheability.

POST and GET have very specific semantics - POST should mean the request changes the data on the system, while GET does NOT. Therefore the response to a POST should not be cached. But the response to a GET may be cached (depending on the headers sent).

NB content is not just cached on the browser.

C.

answered Jun 09 '10 at 11:59

symcbean

47,736
6
59
94

POST requests can be cached if suitable HTTP response headers are sent. – Quentin Jun 09 '10 at 12:05

score 0 · Answer 7 · answered Jun 09 '10 at 12:05

It sounds like you're concerned with not-friendly URLs, i.e., you want to have friendly URLs throughout your site/application. If so, you can continue to use POST in your scenario, but do a redirect after POST. By doing a redirect-after-post, the redirected URL which renders the results of your search can be made friendly and short, while you can use POST to pass more parameters in the request to the server and avoid the long query string associated with the GET URL.

To learn more redirect-after-post, check out this article http://www.theserverside.com/news/1365146/Redirect-After-Post

score 0 · Answer 8 · answered Jun 09 '10 at 12:25

Did you consider:

Submitting the form via GET (or POST), then server-side read the contents of the form (from the url or post data), form a nice url, then 301-redirect to that url.

That way you have complete control of the URL (e.g. its not up to the browser/form how the url looks), and you get all the benefits of using GET, e.g. bookmarkable, linkable, back-button friendly, etc.

Why NOT use POST method here?

8 Answers8