Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:58046
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.170 as permitted sender)
Received-SPF: pass (google.com: domain of ronabop@gmail.com designates 10.216.144.160 as permitted sender) client-ip=10.216.144.160;
MIME-Version: 1.0
In-Reply-To: <4F48153C.7040406@garfieldtech.com>
References: <CAGovj_PbjoB78kXvZcaSkx3qQziMXX7ezVmzYSPHQbJL7uu7VA@mail.gmail.com>
	<8D8E9A0839FE464FBBDF2B499DAFA596@gmail.com>
	<CAGovj_OA29qv0MvpFwaT6EF4h_+CYuirNY8nLBaqGurkdO3Afw@mail.gmail.com>
	<88ad33db205558862288b3114ef4c391.squirrel@www.l-i-e.com>
	<4F480C5B.30606@garfieldtech.com>
	<96462fbc4e243e75b11b455624ac4140.squirrel@www.l-i-e.com>
	<4F4811E6.4050201@garfieldtech.com>
	<CAFWS2+GEX-6yvbMmKi0ffco8LYc9fx94gdC0-18DLo2SxvcuNA@mail.gmail.com>
	<4F48153C.7040406@garfieldtech.com>
Date: Fri, 24 Feb 2012 15:04:47 -0800
Message-ID: <CAFWS2+HhmK3atTYOmsYRC=csOaKTcXTdVh7ucJvwiMS5J9W5qg@mail.gmail.com>
To: Larry Garfield <larry@garfieldtech.com>
Cc: internals@lists.php.net
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] $_PARAMETERS Super Global Object
From: ronabop@gmail.com (Ronald Chmara)

On Fri, Feb 24, 2012 at 2:54 PM, Larry Garfield <larry@garfieldtech.com> wr=
ote:
> On 2/24/12 4:48 PM, Ronald Chmara wrote:
>>
>> On Fri, Feb 24, 2012 at 2:40 PM, Larry Garfield<larry@garfieldtech.com>
>>> Except that per HTTP, GET and POST are completely different operations.
>>> =A0One
>>> is idempotent and cacheable, the other is not idempotent and not
>>> cacheable.
>>> =A0I very much care which someone is using.
>> People exploiting security would *never* think of
>> caching/replaying/modifying =A0a POST request, that's just totally
>> unimaginable! It would take, like HUGE computational effort to like,
>> cURL it or just type it out!
>> er, no.
> Please point out where I said that POST not a security risk. =A0I am quit=
e
> sure I typed no such thing, so how you read such a thing I do not know. =
=A0I
> am genuinely curious to see how you managed to interpret anything I said =
as
> "POST is secure because it won't be cached".

Well, I didn't actually say that you said any such thing. I picked up on:
"the other is not idempotent and not cacheable"
...which is obviously false, and I highlighted, in a security context,
how POSTs are cached, and should be treated with equal distrust as
GET, because both are suspect, user submitted, forms of data, subject
to exploiting.

-Ronabop