Personal Catalogue: PHP & MySQL — Chapter 3, Exercise 3 ==================================================== TASK Explain, in your own words, why delete_item.php requires a POST request rather than allowing a plain link, and describe one real, concrete way a GET-based delete link could be triggered by something other than a deliberate click. SOLUTION HTTP's own convention treats GET requests as "safe" — meaning a GET request is not supposed to change anything on the server, only retrieve data. Every piece of software that interacts with links on the web relies on that convention being true: browsers prefetch links they think the user is about to click, browser extensions and password managers sometimes scan a page's own links, and messaging apps (Slack, Discord, iMessage) generate link previews by having their own server fetch the URL automatically to grab a title and thumbnail. If a delete action were wired up as a plain link — something like Delete — none of those automated fetches are doing anything "wrong" by GET's own convention; they're just following a link. But because this particular link secretly has a side effect (deleting a real database row), any one of those automated fetches would delete item 5 without the user ever consciously clicking anything. A concrete real example: pasting a link to the personal catalogue app into a Slack or Discord channel — even just to show a friend the site — could cause the messaging app's own preview-generation bot to fetch every link in the message, including a delete link, deleting the item as an unintended side effect of just sharing the page. Requiring a POST request instead means the delete can only be triggered by an actual form submission (a real button click that generates a POST body), which none of those automated systems do on their own, since generating a POST request usually requires JavaScript actively submitting a form rather than passively following an href. WHY THIS WORKS AS AN ANSWER ---------------------------- It explains the real mechanical reason (GET is conventionally "safe" and many real systems rely on that convention to auto-fetch links) and gives one concrete, plausible real-world trigger (a chat app's own link-preview bot) rather than a vague "it's more secure."