Faking out GET variables

Exactly what Adam said. Get allows you to save state in a link. For example some modular designs would be like:

www.example.com/?module=friends

And thats how you would display the friends page. You could save this as a link to link directly to the friends page. POST is more secure, but can still be sniffed out. Essentially the page that receives these GET or POST requests is tasked with validating their integrity, my example is not really a security gap. But more secure examples would send passwords encrypted, or send get/post requests with authenticity tokens generated by the backend only good for one request (as is the case with: Click here to reset your password links in emails). The server side application will validate whether the POST or GET request should indeed be processed or not.

Another way sites do this is with cookies, and sessions (either stored in cookies or in the database) to validate the user has access to certain requests or not.

Jason, You are correct that people can fake out the web address on a thank you page. But there's not any harm in that. In some cases, it can even be desirable. If you have a hilarious thank you page that someone might want to share with someone, they can copy the link and paste it into Twitter and all their friends can see it.

The reason to use GET over POST for displaying the confirmation page is the issue with navigation. (I talk about this in the video.) Two examples:

• Imagine the thank you page uses POST and someone refreshes it. The browser will ask them if they want to resubmit the form, and (if they do) it will send another email.
• Also, imagine you have a list of links on the confirmation page. Imagine someone clicks the first one, looks at the page, and then clicks back to get to the list again. The same thing will happen.

You do need POST for receiving the form submission and sending the email (as Adam mentions) but you then want to redirect away from the post to display the confirmation page. You can redirect directly to thanks.php page, or you can redirect to a page that uses a GET variable. Both approaches can be faked by entering the proper URL, but both approaches avoid these problems.

Does that help?

That's actually why POST is a better and more secure way to send info. There are ways you can use GET more securely but POST is better for sending info to your app or backend.