title: Recommendation for POST vs GET
body: <p>I'm working on some quiz script, found one from internet, everything works like a charm, but i need to modify for security reasons.
  Actually i use $_GET , but i'm afraid about sql injections.</p>
  
  <p>I'll let here all my script, and if someone can help me with suggestions, will be great. I tried so many things to make script non-vulnerable, but even .htaccess didn't helped me!</p>
  
  <p>1.php quiz page with form</p>
  
  <pre><code>&lt;?php
      //Set question number
      $number = (int) $_GET['n'];
  
      //Get total number of questions
      $query = "select * from questions";
      $results = $mysqli-&gt;query($query) or die($mysqli-&gt;error.__LINE__);
      $total=$results-&gt;num_rows;
  
      // Get Question
      $query = "select * from `questions` where question_number = $number";
  
      //Get result
      $result = $mysqli-&gt;query($query) or die($mysqli-&gt;error.__LINE__);
      $question = $result-&gt;fetch_assoc();
  
  
      // Get Choices
      $query = "select * from `choices` where question_number = $number";
  
      //Get results
      $choices = $mysqli-&gt;query($query) or die($mysqli-&gt;error.__LINE__);
  
   ?&gt;
  
  &lt;?php echo $question['question'] ?&gt;
  
  &lt;form method="post" action="../p/process.php" class="table-responsive"&gt;
  &lt;?php while($row=$choices-&gt;fetch_assoc()): ?&gt;
  
  &lt;button type="submit" class="btn btn-info btn-block" name="choice" value="&lt;?php echo $row['id'] ?&gt;"&gt;&lt;?php echo $row['choice']; ?&gt;&lt;/button&gt;
  
  &lt;?php endwhile; ?&gt;
                                                                                  &lt;input type="hidden" name="number" value="&lt;?php echo $number; ?&gt;" /&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>process.php page</p>
  
  <pre><code> //Check to see if score is set_error_handler
      if (!isset($_SESSION['score'])){
         $_SESSION['score'] = 0;
      }
  
  //Check if form was submitted
  if($_POST){
      $number = $_POST['number'];
      $selected_choice = $_POST['choice'];
      $next=$number+1;
      $total=10;
  
      //Get total number of questions
      $query="SELECT * FROM `questions` LIMIT 10";
      $results = $mysqli-&gt;query($query) or die($mysqli-&gt;error.__LINE__);
      $total=$results-&gt;num_rows;
  
      //Get correct choice
      $q = "select * from `choices` where question_number = $number and is_correct=1";
      $result = $mysqli-&gt;query($q) or die($mysqli-&gt;error.__LINE__);
      $row = $result-&gt;fetch_assoc();
      $correct_choice=$row['id'];
  
  
  
      //compare answer with result
      if($correct_choice == $selected_choice){
          $_SESSION['score']++;
      }
  
      if($number == $total){
          header("Location: ../final.php");
          exit();
      } else {
              header("Location: ../f/1.php?n=".$next."&amp;score=".$_SESSION['score']);
      }
  }
  </code></pre>
  
  <p>As like i said, everyhing works fine, i'm ussing that script for 2 months already, but i'm afraid.
  Current URL looks like: f/1.php?n=1&amp;score=1
  Will be nice if someone can help me.
  Thank you</p>