The difference between get and post in HTTP

HTTP defines different ways to interact with the server, with 4 basic methods, namely get,post,put,delete. The URL full name is a resource descriptor, it can be said that: a URL address, which is used to describe a network of resources, and HTTP Get,post,put,delete in the corresponding to the resources of the search, change, increase, delete 4 operations. Presumably, get is typically used to get/query resource information, and post is typically used to update resource information.

From a theoretical perspective:

One, according to the HTTP specification, get is used for information acquisition and should be secure and idempotent.

1. The so-called security means that the operation is used to obtain information rather than modify information. In other words, GET requests should generally not have side effects. It simply gets the resource information, just like a database query, without modification, adding data without affecting the state of the resource. (* Note: The meaning of security here is simply non-modification information.) ）
2. Idempotent, meaning that multiple requests to the same URL should return the same result.

Explain the concept of idempotent :

idempotent (idempotent, idempotence) is a mathematical or computer concept that is common in abstract algebra.

idempotent is defined in the following ways:
For monocular operations, if an operation is the same for all the numbers in the range, the result of the operation is the same as the result of doing the operation once, then we call the Operation Idempotent. For example, the absolute value operation is an example, in the real number set, there is abs (a) =abs (ABS (a)).
For binocular operations, it is required that when the two values of the participating operations are equal, if the results of the operation are equivalent to the two values of the participating operations, the power of the operation is called, such as the function of the maximum value of two numbers, in the real concentration idempotent, that is, max (x,x) = x.

In practical applications, the 2 rules of safety and power are not so stringent. For example, the front page of a news site is constantly being updated. Although the second request returns a different batch of news, the operation is still considered safe and idempotent, as it always returns the current news. Fundamentally, if the goal is that when a user opens a link, he can be confident that the resource is not changed from its point of view.

Second, according to the HTTP specification, post represents the possibility to modify requests for resources on the server.

Continue to cite the example above: or the news to the website as an example, readers of the news to publish their own comments should be done through post, because after the comments submitted site resources have been different, or that the resources have been modified.

The above two points are some of the original rational issues of Get and post in the HTTP specification. But when actually doing, many did not follow the HTTP specification to do, causes this problem many reasons, for example says:

1. Many people are greedy and use get when updating resources. Because a form (form) must be used for post, this can be a bit of a hassle.
2. The increase of resources, delete, change, check operation, in fact, can be completed through get/post, do not need to use put and delete.
3. The early web MVC framework designers did not consciously view and design URLs as abstract resources, so a more serious problem was that the traditional web MVC framework basically supported only get and post two HTTP methods, rather than the put and delete methods.

Explain MVC: MVC exists in the desktop program, m refers to the data model, v refers to the user interface, and C is the controller. The purpose of using MVC is to separate the implementation code for M and v so that the same program can use a different representation.

The above 3 points typically describe the style of the stereotype (the HTTP specification is not strictly adhered to). With the development of the architecture, rest (representational state transfer representational status transfer) now appears, a new style that supports the HTTP specification. For details, refer to RESTful Web Services.

From the surface looks like:

One:

The data for the GET request is appended to the URL (that is, the data is placed in the HTTP protocol header), to split the URL and transfer the data, and the parameters are connected &, for example: Login.action?name=hyddd&password=idontknow &VERIFY=%E4%BD%A0%E5%A5%BD. If the data is an English letter/number, sent as is, if it is a space, converted to +, if it is Chinese/other characters, the string is directly encrypted with BASE64, such as:%E4%BD%A0%E5%A5%BD (where xx in%xx is the symbol in 16 binary notation ASCII).

Post submits the data to the packet in the HTTP packet.

Two:

• There is the article said (get the data submitted at most can only be 1024 bytes, theoretically post No limit, can be transmitted a large amount of data, IIS4 in the maximum of 80kb,iis5 100KB) This sentence is wrong, inaccurate!

1, The first is that "get-committed data can be up to 1024 bytes" because get commits data through a URL, so the amount of data that get can commit is directly related to the length of the URL. In fact, the URL does not have the upper limit of the argument, the HTTP protocol specification does not limit the length of the URL. This restriction is restricted to specific browsers and servers. IE's limit on URL length is 2083 bytes (2k+35). For other browsers, such as Netscape, Firefox, etc., there is theoretically no length limit, and its limitations depend on the support of the operating system. This is the limit for the entire URL length, not just your parameter value data length.

2, in theory, the post is no size limit, the HTTP protocol specification is not a size limit, said "post data volume exists 80k/100k size limit" is inaccurate, post data is not limited, the limit is the processing capacity of the server handler.

For ASP programs, the request object has a 100K data length limit when processing each form field. However, if you use Request.BinaryRead, you do not have this limitation. By this extension, for IIS 6.0, Microsoft has increased its restrictions for security reasons. We also need to note:

1). IIS 6.0 default ASP post data is up to 200KB, and each form field limit is 100KB.
2). The maximum size of the IIS 6.0 default upload file is 4MB.
3). The default maximum request header for IIS 6.0 is 16KB.
These restrictions do not precede IIS 6.0.

So the above 80k,100k may just be the default value (note: I have not confirmed the parameters of IIS4 and IIS5), but I am sure I can set it myself. Because each version of IIS does not have the same default values for these parameters, refer to the relevant IIS configuration documentation.

3, in ASP, the server obtains the GET request parameter with Request.QueryString, obtains the POST request parameter with the Request.Form. In JSP, with Request.getparameter (\ "xxxx\") to obtain, although JSP also has the request.getquerystring () method, but the use of more trouble, such as: Pass a test.jsp?name= HYDDD&PASSWORD=HYDDD, with Request.getquerystring () is: name=hyddd&password=hyddd. In PHP, you can use $_get and $_post to get the data in the get and post separately, while $_request can get the data from the get and post two requests. It should be noted that the use of request in JSP and PHP in the use of $_request will have a hidden danger.

The security of the 4,post is higher than the security of get. Note: The security described here is not the same concept as the "security" mentioned in get above. The meaning of "security" above is simply not to make data changes, and the meaning of security here is the meaning of true security, such as: submit data through get, user name and password will appear in plaintext on the URL, because (1) the login page may be cached by the browser, (2) Other people to view the browser's history, Then other people can get your account number and password, in addition, using get to submit data may also cause Cross-site request forgery attack.

Summary: Get is a request to send data to the server, and post is a request to submit data to the server, in form (form), method defaults to "get", in essence, get and post just send mechanism is different, not one to take a hair!

Data Summary! If there are errors, please correct, do not like to spray!!!

The difference between get and post in HTTP