Question

I understand that I am able to use the POST method for URL parameters to display data according to a specific variable, I know how to make use of the GET method – but I am told that the POST method can be used to hide the part of the URL that is like this.

/data.php?parameter=1234

What is the actual difference of the two methods in terms of URL parameters?

Below is some code that fetches data from a database according to the id of a specific link

    <?php
//This includes the variables, adjusted within the 'config.php file' and the functions from the 'functions.php' - the config variables are adjusted prior to anything else.
require('configs/config.php');
require('configs/functions.php');

    //This is the actual interaction with the database, according to the id.
    $query = mysql_query("SELECT * FROM table WHERE id=" .$_GET['id'] . ";") or die("An error has occurred");

            //This re-directs to an error page the user preventing them from viewing the page if there are no rows with data equal to the query.
    if( mysql_num_rows($query) < 1 )
{
  header('Location: 404.php');
  exit;
}

    //Here each cell in the database is fetched and assigned a variable.
    while($row = mysql_fetch_array($query))
    {
        $id = $row['id'];
        $title = $row['title'];
        $month = $row['month'];
        $day = $row['day'];
        $photo = $row['photo'];
        $text = $row['text'];    
    }
?>

On a separate page I generate links to the data.php file according to the ID like so:

<a href="post.php?id=<?php echo $content['id']; ?>"><?php echo $content['title']; ?></a>

Forgetting that there are potential SQL injections that can occur through the above code, how would I go about making use of the POST method in order to hide the URL parameters, or at least not display them like this:

http://example.com/data.php?id=1

Answer 1

In order to use POST, you will need to use a <form> tag, and depending on how you are pulling up these URLs, it could be easier to use javascript to help out. Here’s a basic example:

<form method="post" action="data.php">
    <input type="hidden" name="parameter" value="1234" />
    <input type="submit" value="Go" />
</form>

The Go button would POST the form data, and now in data.php you will be able to retrieve the value from $_POST['parameter']. Note that when using POST, you will probably want to redirect (HTTP 302) back to a page so that when a user hits the back button, the browser doesn’t prompt to resubmit the form.

Using javascript, you could set the parameter input to a different value before posting the form.