GET or POST – Secure

GET is NOT Secure

GET is not a secure method of sending data. Don’t use it for forms that send password info, credit card data or other sensitive information. Since the data is passed through as part of the URL, it’ll show up in the web server’s logfile (complete with all the data). Server logfiles are often readable by other users on the system. URL history is also saved in the browser and can be viewed by anyone with access to the computer. Private information should always be sent with the POST method, which we’ll cover in the next chapter. (And if you’re asking visitors to send sensitive information like credit card numbers, you should also be using a secure server in addition to the POST method.)

There may also be limits to how much data can be sent with GET. While the HTTP protocol doesn’t specify a limit to the length of a URL, certain web browsers and/or servers may.

Despite this, the GET method is often the best choice for certain types of applications. For example, if you have a database of articles, each with a unique article ID, you would probably want a single article.cgi program to serve up the articles. With the article ID passed in by the GET method, the program would simply look at the query string to figure out which article to display:

<a href=”article.cgi?id=22″> Article Name</a>