Forms: GET and POST

GET represents safe retrieval and exposes fields in the URL; POST carries a body and commonly performs change. HTTPS—not method choice—provides transport confidentiality.

Practical example

<?php
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
  $email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
  if ($email === false || !hash_equals($_SESSION['csrf'], $_POST['csrf'] ?? '')) { http_response_code(422); exit; }
  header('Location: /success', true, 303); exit;
}

Use the correct upload enctype, enforce every rule server-side, and implement CSRF protection for authenticated state changes. Post/Redirect/Get prevents refresh resubmission. Escape redisplayed values for their exact output context.