Is there any good reason why I should care about if parameters have been passed via GET or POST?

web-applications

Solution

I think everyone's missing the point of your question (or maybe I'm just misunderstanding it.) You're not asking the difference between GET/POST, you're wondering if its a good or bad idea for the framework that you're building to automatically merge the results of these two together into one safe variable. Both .Net and PHP do this so I don't see why not.

In PHP you can use `$_GET` or `$_POST` for a specific method or just `$_REQUEST`. Same with .Net, `Request.QueryString` and `Request.Form` vs `Request`. If someone has a reason to only get the POST/GET the variables are still there.

Problem

In the design process of my framework, I come to a point where I think about merging POST and GET parameters into one single $parameters variable. The advantage for the developer: The framework filters all parameter values to secure agains XSS-attacks (i.e. funny kids inserting bad javascript code to redirect visitors to a spam site) and other sort of useful validation / filtering. But as usual: Is there any real advantage to separating POST and GET, without respect to that they are just different because they come from different sources? I mean: Does that matter? Would it be "good design" at any point, when a POST parameter has the same name as an GET parameter, and both are really used? In my eyes that's ugly, but maybe someone has a good explanation why I should not even attempt to merge POST and GET. I would consider POST to be overriding GET in any case. I hope for honest answers :-)

Original source