I am reviewing a system (an old system) in which in some cases, they send data in a form with POST method, but they also send parameters to the url, as if using get.

something like this:

```
echo "\n<FORM METHOD='POST' NAME='onegroup' ACTION='menu.php?sesion=".$sesion."' >
    <INPUT TYPE='HIDDEN'    NAME='sesion'   VALUE='".$sesion."'>
    <INPUT TYPE='HIDDEN'    NAME='index_login'   VALUE='1'>
[...]   
</FORM>\n";

```

(note, `sesion` is not a typo, is just the word "session" in spanish)

What happens is that the "`sesion`" parameter gets sent both by url and by an input field, thus, the 'sesion' variable is then received both in the `$_POST` array and the `$_GET` array.

Why would this be necessary and should i leave it like that? or could i just take it off from the url and just rely on the `$_POST` data?

I have read in the comments for [this](https://stackoverflow.com/a/6730227/1385198) answer that it is perfectly possible and valid to send data from both GET and POST (although the method itself is only either GET or POST (or others) in this case is POST, because that is the way the form defines). Now in this specific case, why would someone want to send the SAME `sesion`variable (i.e. with the same value) by both get (by url) and post requests?

In my menu.php script can read both `$_POST` and `$_GET` and each will have its "version" of the variable, but it happens to be the same.
I've also played around and saw that if instead of $\_POST or `$_GET` i read the `$_REQUEST` array, i get all the variables together, but in the case of the duplicated one (`sesion`), the post version gets precedence. 

Another thing is that they rely on the "Register Globals" option, and thus, instead of explicitly using `$_GET["sesion"]` or `$_POST["sesion"]` (or even `$_REQUEST[]`) they just use '$sesion' everywhere to use that information (and just the same for any other variable in the request). Again, playing around, i see that in that case, the POST version of the variable gets precedence also. But can I always rely on that?

Should I just use the post method and remove the parameter from the url?

Why would they want to do this instead of just sending everything by post? As I see it, there is no reason of using both, specially since both have the SAME value. If they didn't they could just choose which version to use, but that is not the case, and I can't think of anything other that it is just something they left there and never "fixed"

What are some "real-life" examples in which someone would need to use such scenario with both POST and GET requests, and specially with the same variable name in both? 

thanks.