Tofauti Kati ya GET na POST katika PHP

GET na POST ni njia zinazotumika kutuma taarifa kutoka browser kwenda kwenye server. Zote zinaweza kutumiwa kwenye PHP, lakini zina matumizi na kiwango tofauti cha usalama.

GET ni Nini?

GET hutuma taarifa kupitia URL.

Mfano:

post.php?id=25

PHP inaweza kupokea ID hiyo kwa kutumia:

$postId = (int)($_GET['id'] ?? 0);

GET inafaa kwa shughuli ambazo hazibadilishi database, kama:

• Kufungua post.
• Kutafuta taarifa.
• Kuchagua category.
• Kuchuja matokeo.
• Kubadilisha page ya pagination.
• Kufungua fomu ya ku-edit.

Mfano wa search form:

<form method="get">
    <input type="text" name="search">
    <button type="submit">Search</button>
</form>

Kupokea taarifa:

$search = trim($_GET['search'] ?? '');

POST ni Nini?

POST hutuma taarifa ndani ya request body badala ya kuzionyesha moja kwa moja kwenye URL.

Mfano:

<form method="post">
    <input type="text" name="title">
    <textarea name="content"></textarea>
    <button type="submit">Save Post</button>
</form>

PHP inapokea taarifa kwa kutumia:

$title = trim($_POST['title'] ?? '');
$content = trim($_POST['content'] ?? '');

POST inafaa kwa shughuli zinazobadilisha taarifa, kama:

• Kuongeza post.
• Kubadilisha post.
• Kufuta post.
• Kuunda account.
• Login.
• Kutuma malipo.
• Kupakia picha au documents.

Tofauti Kuu Kati ya GET na POST

Mfano Hatari wa Kufuta kwa GET

Code hii ni hatari:

if (isset($_GET['delete'])) {
    $postId = (int)$_GET['delete'];

    $stmt = $pdo->prepare(
        "DELETE FROM posts WHERE id = ?"
    );

    $stmt->execute([$postId]);
}

Post inaweza kufutwa kwa kutembelea URL hii:

edit_post.php?delete=25

Crawler, bot au mtu mwingine anaweza kufungua URL hiyo na kusababisha post kufutwa.

Delete link kama hii pia ni hatari:

<a href="edit_post.php?delete=25">
    Delete
</a>

Mfano Salama wa Kufuta kwa POST

Kwanza, hakikisha admin ameingia:

session_start();

if (empty($_SESSION['user_id'])) {
    header('Location: login.php');
    exit;
}

Tengeneza CSRF token:

if (empty($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(
        random_bytes(32)
    );
}

Tengeneza delete form:

<form method="post"
      onsubmit="return confirm(
          'Una uhakika unataka kufuta post hii?'
      );">

    <input
        type="hidden"
        name="csrf_token"
        value="<?= htmlspecialchars(
            $_SESSION['csrf_token']
        ) ?>"
    >

    <input
        type="hidden"
        name="post_id"
        value="<?= (int)$post['id'] ?>"
    >

    <button type="submit" name="delete_post">
        Delete
    </button>
</form>

Kwenye PHP, hakiki request na CSRF token:

if (
    $_SERVER['REQUEST_METHOD'] === 'POST'
    && isset($_POST['delete_post'])
) {
    $token = $_POST['csrf_token'] ?? '';

    if (
        !is_string($token)
        || !hash_equals(
            $_SESSION['csrf_token'],
            $token
        )
    ) {
        exit('Security check failed.');
    }

    $postId = (int)($_POST['post_id'] ?? 0);

    if ($postId <= 0) {
        exit('Invalid post ID.');
    }

    $stmt = $pdo->prepare(
        "DELETE FROM posts WHERE id = ?"
    );

    $stmt->execute([$postId]);
}

Ongeza Uthibitisho wa Password

Kwa usalama zaidi, mtumiaji anaweza kuingiza password yake kabla ya kufuta:

<input
    type="password"
    name="current_password"
    required
    autocomplete="current-password"
>

Hakiki password:

$stmt = $pdo->prepare(
    "SELECT password
     FROM users
     WHERE id = ?
     LIMIT 1"
);

$stmt->execute([
    (int)$_SESSION['user_id']
]);

$passwordHash = $stmt->fetchColumn();

if (
    !$passwordHash
    || !password_verify(
        $_POST['current_password'] ?? '',
        $passwordHash
    )
) {
    exit('Password si sahihi.');
}

Baada ya hapo ndipo DELETE itekelezwe.

Je, POST Pekee Inatosha?

Hapana. POST inapaswa kuunganishwa na:

• Login protection.
• HTTPS.
• CSRF token.
• Prepared statements.
• Password confirmation kwa shughuli hatari.
• Validation ya post ID.
• Confirmation message.
• Rate limiting.
• Backup ya database.

POST haifichi taarifa dhidi ya mtu anayesikiliza mtandao ikiwa website haitumii HTTPS.

Kanuni Rahisi ya Kukumbuka

Tumia GET kwa kusoma taarifa:

GET = View, Search, Filter

Tumia POST kwa kubadilisha taarifa:

POST = Create, Update, Delete, Login

Hitimisho

GET inafaa kwa kufungua na kutafuta taarifa ambazo hazibadilishi database. POST inafaa kwa kuongeza, kubadilisha au kufuta taarifa.

Kamwe usifute post kupitia URL kama:

?delete=25

Tumia POST yenye login, CSRF token, prepared statement na uthibitisho wa password ili kuzuia crawler, bot au mtu asiyeidhinishwa kufuta taarifa.