Data Transport Methods Across Webpages
28th
May 2016, 17:57
Web developers all know that there the Internet is a stateless medium and to mitigate that unfortunate fact, there are two basic ways of transporting data across pages - GET and POST. While this is bread-and-butter stuff for all who deal with the web, ultimately not every developer understands GET and POST as well as they should, mostly operating on a vague understanding of which to use, and when.
And that is why, today I'll be dealing with both cases.
is the same as
The GET method of transporting data basically embeds the data in the URL in data-value pairs separated by ampersands. Assuming that this form is in a page named tt_test.asp, submitting the form would give you a URL of:
This also means that you can use the GET method to transport data without using a form.
Caching - Since GET is essentially a URL, it follows that pages generated from the GET method may also be cached, and this shaves valuable time off page loads. URL caching in turn facilitates pages generated using the GET method being crawled by search engines, which leads to better Search Engine Optimization. And this is the one thing that cements GET its place as a viable method of data transport despite its obvious inferiority to POST in many areas.
Format - GET can send only text data. Even then, special characters have to be encoded. If, for example, you wanted to send an ampersand as part of your data, you would have to be very careful that the it is not mistaken as a separator.
Security - The data appears in the URL. Duh.
... data that does not need to be private.
... complex data
... long strings
It's time to look at the other method of sending data.
Versatility in data formats and lengths - You can send long paragraphs of text, in addition to everything you can already send via GET. Also, and this is no trivial matter, you can send binary files.
... data that needs to be kept private, e.g. transactions or passwords.
... pages where backwards-forwards navigation is an issue.
On the other hand, I've been guilty of using POST when it would have been more beneficial to use a GET instead. Oh, well. Live and learn.
The lesson for the day is - the correct tool for the correct job. Whatever you end up choosing, exercise appropriate caution.
Tags
See also
And that is why, today I'll be dealing with both cases.
The GET method
The GET method is the default way of transporting data. In a HTML form, if the method attribute is not specified in the form tag, the browser automatically assumes a GET. Here's an example. Pay attention to the form tag.
<form>
<input name="x" value="test">
<input name="y" value="12345">
<input type="submit" name="btSubmit" value="submit">
</form>
<input name="x" value="test">
<input name="y" value="12345">
<input type="submit" name="btSubmit" value="submit">
</form>
is the same as
<form method="GET">
<input name="x" value="test">
<input name="y" value="12345">
<input type="submit" name="btSubmit" value="submit">
</form>
<input name="x" value="test">
<input name="y" value="12345">
<input type="submit" name="btSubmit" value="submit">
</form>
The GET method of transporting data basically embeds the data in the URL in data-value pairs separated by ampersands. Assuming that this form is in a page named tt_test.asp, submitting the form would give you a URL of:
tt_test.asp?x=test&y=12345&btSubmit=submit
This also means that you can use the GET method to transport data without using a form.
Pros
Quick and dirty - As mentioned, you don't need a form to send data via the GET method. You merely need to formulate the URL properly.Caching - Since GET is essentially a URL, it follows that pages generated from the GET method may also be cached, and this shaves valuable time off page loads. URL caching in turn facilitates pages generated using the GET method being crawled by search engines, which leads to better Search Engine Optimization. And this is the one thing that cements GET its place as a viable method of data transport despite its obvious inferiority to POST in many areas.
Cons
Size limitations - The URL can hold only that much data. Therefore using GET to send long strings of data (over 1000 characters including the URL, depending on browser) is not advisable.Format - GET can send only text data. Even then, special characters have to be encoded. If, for example, you wanted to send an ampersand as part of your data, you would have to be very careful that the it is not mistaken as a separator.
Security - The data appears in the URL. Duh.
Use GET for...
... simple data that can be easily sanitized and whitelisted.... data that does not need to be private.
Do not use GET for...
... data that should be hidden, such as passwords.... complex data
... long strings
Absolutely do not use GET for...
... entire SQL queries (Jesus Christ, do you have a death wish or something?!)
tt_test.asp?query=SELECT x from table_y WHERE id=3
It's time to look at the other method of sending data.
The POST method
The POST method is a more effective way of sending data. The data is embedded in the headers and sent to the next page.
<form method="POST">
<input name="x" value="test">
<input name="y" value="12345">
<input type="submit" name="btSubmit" value="submit">
</form>
<input name="x" value="test">
<input name="y" value="12345">
<input type="submit" name="btSubmit" value="submit">
</form>
Pros
Way more secure than GET - All data is hidden. Note that I said more, not totally secure. POST has its vulnerabilities which we'll explore at a later date.Versatility in data formats and lengths - You can send long paragraphs of text, in addition to everything you can already send via GET. Also, and this is no trivial matter, you can send binary files.
Cons
Breaks page flow - clicking on the Back button or reloading the page will cause a popup to appear, asking if you wish to re-send your data. Depending on the nature of your data, re-sending the data may cause something to break. Below is a sample of this popup. The message varies from browser to browser.Popup box
Use POST for...
... almost everything. Long and complex data, especially files.... data that needs to be kept private, e.g. transactions or passwords.
Do not use POST for...
... pages you may want to be cached.... pages where backwards-forwards navigation is an issue.
The methods in a nutshell
The GET method has a well-deserved reputation for being widely used - sometimes overused. I once spoke to a software developer who looked upon GET with disdain and was of the opinion that GET is an unsafe and "cheap" way of sending data. She was only half right. GET is all that, and so much more. There is a place for everything, and GET is no exception. GET has its uses - some of which are not immediately apparent to people who aren't web developers.On the other hand, I've been guilty of using POST when it would have been more beneficial to use a GET instead. Oh, well. Live and learn.
The lesson for the day is - the correct tool for the correct job. Whatever you end up choosing, exercise appropriate caution.
That's all for the time being. I'll POST again soon. (snicker)
