WebApp Sec: Re: IIS log - GETs vs. POSTs

[Lucas Holt <luke () foolishgames com>]

Bottom line, use POST when possible.  Also buy an SSL key for web 
applications.
I'd like to comment on this example:
<FORM METHOD="POST" ACTION="/cgi-bin/useradd.cgi?data">

In this case, aren't you posting to a URL with a query string?  The 
official reason for using POST requests is for bodies that are larger 
than the common default accepted by user agents.  Query strings can 
only be so long.  Information hiding is a side benefit.
I think people should realize that using POST does not make your 
application secure in any way.  You must check user input.  I could 
take lynx, hack the source, and add a feature to change hidden 
variables on forms, etc.  I've actually seen plugins to do that with 
Mozilla.  Programming web applications is far more serious than 
conventional apps.. because EVERYONE can access/attack them.  Its a lot 
like having a windows machine on the internet with no firewall or 
patches. :)

Lucas Holt
Luke () FoolishGames com