title: Do XSS attacks only happen with GET and a POST request?
body: <p>I was watching a tutorial and the tutor put a XSS filter on a GET request only app. </p>
  
  <p>My understanding of cross site scripting is using POST and GET. A “hacker” POSTs a script to the server and when your Web app makes a GET request it receives that script and the browser runs it when the script data loads onto the page. </p>
  
  <p>This can effect all users viewing the page where the data (script) is recieved.</p>
  
  <p>How would you be vulnerable if you had and only had a GET request web app?</p>