What are the potential pitfalls of using $_GET and $_POST methods for button actions in PHP?

Using $_GET and $_POST methods for button actions in PHP can lead to security vulnerabilities such as CSRF attacks or accidental data manipulation. To prevent this, it's recommended to use a unique token for each form submission and validate it on the server side before processing the action. 

<?php
session_start();

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    if (isset($_POST['token']) && isset($_SESSION['token']) && $_POST['token'] === $_SESSION['token']) {
        // Process the form submission
        // Your code here
        unset($_SESSION['token']); // Remove token to prevent reuse
    } else {
        // Invalid token, handle error
    }
}

$token = bin2hex(random_bytes(32));
$_SESSION['token'] = $token;
?>

<form method="post">
    <input type="hidden" name="token" value="<?php echo $token; ?>">
    <!-- Other form fields here -->
    <button type="submit">Submit</button>
</form>

Keywords

$_GET $_POST button actions security vulnerabilities data manipulation

Related Questions