在PHP中使用cURL进行GET或POST发送参数更安全

Question

I want to connect in a secure way with an API and I am using cURL to do it using HTTPS and SSL.

Now, i was wondering what is better in terms of security, sending the data through GET or POST :

$ch = curl_init("http://api.website.com/connect.php?user=xxx&pass=xxxx");
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST,  2);

$result = curl_exec($ch);
curl_close($ch);

Or

$param['user'] = 'xxxx';
$param['pass'] = 'xxxx';
$ch = curl_init("http://api.website.com/connect.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $Parameters);

curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST,  2);

$result = curl_exec($ch);
curl_close($ch);

I also realized that POST is much more slower retrieving the data.

Answer 1

Neither. "GET parameters" are part of the URL which is part of the HTTP request header, "POST parameters" are part of the HTTP request body. Both are part of the same HTTP request, which is all just plain text. There's no difference in "security".

Use GET or POST semantically depending on the kind of request, not because of security concerns.

The only thing is that the requested URLs are more likely to appear in log files than the entire request body. But the one logging would be the service you send the data to anyway, so it doesn't make much of a difference.

Answer 2

None of them is secure, but if you use a secure connection (https) you can use POST, asthe body will get encrypted. It is not a good idea to send passwords, not even usernames with the URI.

Answer 3

In this cause because you are using HTTPS, GET and POST as just as secure as eachother because both of which will be encrypted on the transport layer.

If for example you weren't using HTTPS then in some cases, POST can be better but not necessarily more secure . This is because servers typically log the querystring whereas POST data isn't typically logged.