title: Drupal Ajax: Passing values by url vs data param
body: <p>What is the difference between using:</p>
  
  <pre><code> $.ajax({
    type: 'POST',
    url: Drupal.settings.basePath + 'module/get/' + node,
    dataType: 'json',
    data: { 'ajax' : true }
   });
  </code></pre>
  
  <p>versus:</p>
  
  <pre><code> $.ajax({
    type: 'POST',
    url: Drupal.settings.basePath + 'module/get',
    dataType: 'json',
    data: { 'ajax' : true, 'node' : node }
   });
  </code></pre>
  
  <p>In the first case you'd access the node variable as a parameter in the callback function and in the second case you'd access it with $_POST['node'] right? Wouldn't the second method always be better, but I see a lot of people doing it the first way. Not to say that the second way is that secure either. Still looking into form tokens, but trying to figure out this basic bit first.</p>
  
  <p>Also wondering for case 1, assuming this ajax is triggered by a button, how do you stop a person from entering directly into the url, mysite/module/get/20 and activating it? Does simply checking that $_POST['ajax'] == true do that? Or is there still a security hole there?</p>