Change the state of DB thru GET?
<p><strong>addCategory.php</strong></p>

<pre><code>&lt;?php
$parentId = isset($_GET['parentId']) ? $_GET['parentId'] : 0;

$categoryName = $categoryDescription = "";
$fail = "";


if (isset($_POST['submit'])) {  

    if (isset($_POST['categoryName']))
        $categoryName = fix_string($_POST['categoryName']);

    if (isset($_POST['categoryDescription']))
        $categoryDescription = fix_string($_POST['categoryDescription']);

    $hidParentId = $_POST['hidParentId'];
}

$fail  = validate_category_name($categoryName);
$fail .= validate_category_description($categoryDescription);


echo "&lt;html&gt;&lt;head&gt;&lt;title&gt;An Example Form&lt;/title&gt;";

if ($fail == "") {
  echo "success";

    header("Location: processCategory.php?action=add&amp;categoryName=$categoryName&amp;categoryDescription=$categoryDescription&amp;hidparentId=$hidParentId");

    exit;
}

// Now output the HTML and JavaScript code
?&gt;

&lt;!-- The HTML section --&gt;

&lt;style&gt;.signup { border: 1px solid #999999;
    font: normal 14px helvetica; color:#444444; }&lt;/style&gt;
&lt;script type="text/javascript"&gt;
function validate(form)
{

    fail  = validateCategoryName(form.categoryName.value)
    fail += validateCategoryDescription(form.categoryDescription.value)

    if (fail == "") return true
    else { alert(fail); return false }
}
&lt;/script&gt;&lt;/head&gt;&lt;body&gt;
&lt;table class="signup" border="0" cellpadding="2"
    cellspacing="5" bgcolor="#eeeeee"&gt;
&lt;th colspan="2" align="center"&gt;Add Category&lt;/th&gt;

&lt;?php

if (isset($_POST['submit'])) {
?&gt;

&lt;tr&gt;&lt;td colspan="2"&gt;Sorry, the following errors were found&lt;br /&gt;
in your form: &lt;p&gt;&lt;font color=red size=1&gt;&lt;i&gt;&lt;?php echo $fail ?&gt;&lt;/i&gt;&lt;/font&gt;&lt;/p&gt;
&lt;/td&gt;&lt;/tr&gt;

&lt;?php 
}
?&gt;

&lt;form method="post" action="&lt;?php echo $_SERVER['PHP_SELF']; ?&gt;?parentId=&lt;?php echo $parentId; ?&gt;"
    onSubmit="return validate(this)"&gt;
     &lt;tr&gt;&lt;td&gt;Category Name&lt;/td&gt;&lt;td&gt;&lt;input type="text" maxlength="32"
    name="categoryName" value="&lt;?php echo $categoryName; ?&gt;" /&gt;&lt;/td&gt;
    &lt;/tr&gt;&lt;tr&gt;&lt;td&gt;Category Description&lt;/td&gt;&lt;td&gt;&lt;input type="text" maxlength="32"
    name="categoryDescription" value="&lt;?php echo $categoryDescription; ?&gt;" /&gt;&lt;/td&gt;

    &lt;input type="hidden" name="hidparentId" value="&lt;?php echo $parentId; ?&gt;" /&gt;

&lt;/tr&gt;&lt;tr&gt;&lt;td colspan="2" align="center"&gt;
    &lt;input type="submit" name="submit" value="ok" /&gt;&lt;/td&gt;
&lt;/tr&gt;&lt;/form&gt;&lt;/table&gt;

&lt;!-- The JavaScript section --&gt;

&lt;script type="text/javascript"&gt;
function validateCategoryName(field) {
    if (field == "") return "No name entered.\n"
    return ""
}

function validateCategoryDescription(field) {
    if (field == "") return "No description entered.\n"
    return ""
}

&lt;/script&gt;&lt;/body&gt;&lt;/html&gt;

&lt;?php
// Finally, here are the PHP functions

function validate_category_name($field) {
    if ($field == "") return "No name entered&lt;br /&gt;";
    return "";
}

function validate_category_description($field) {
    if ($field == "") return "No description entered&lt;br /&gt;";
    return "";
}

function fix_string($string) {
    if (get_magic_quotes_gpc()) $string = stripslashes($string);
    return htmlentities ($string);
}

?&gt;
</code></pre>

<p><br/><br/></p>

<p><strong>processCategory.php</strong></p>

<pre><code>&lt;?php
$action = isset($_GET['action']) ? $_GET['action'] : '';
switch ($action) {

    case 'add' :
        addCategory();
        break;

    case 'modify' :
        modifyCategory();
        break;

    case 'delete' :
        deleteCategory();
        break;

    default :
        // if action is not defined or unknown
        // move to main category page
        header('Location: index.php');
}


/*
    Add a category
*/
function addCategory() {



    $name        = $_GET['categoryName'];
    $description = $_GET['categoryDescription'];
    $parentId  = $_GET['hidparentId'];

    $sql   =  "INSERT INTO tbl_category (cat_parent_id, cat_name, cat_description) 
            VALUES ($parentId, '$name', '$description')";
    $result = dbQuery($sql) or die('Cannot add category' . mysql_error());

    header('Location: index.php?catId=' . $parentId);     

}

function modifyCategory() {

}

function deleteCategory() {

}

?&gt;
</code></pre>

<p>
Notice here that I get the user inputs thru POST then send that POST data to same .php file......then after validation send those data to another .php file THRU GET.....insert those GET data to the DB then after inserting those data we redirect to another page.</p>

<p>
I read that if your changing the state of the database you should use POST not GET. My idea that it is bad because GET data can be seen in the URL so users can change the state of the database in the URL, another is when you click refresh if you use POST then the browser will warn you that your trying to repeat the same method again, BUT if you use GET the browser will not warn you so end up posting the same data twice.</p>

<p>
In my code there is no way the user can manipulate the url to change the DB because as soon as the data is inserted we redirect to different page, and also the refresh problem is not a problem here.
</p>

<p></p>
I want to a place separated where I process my inputs and that is processCategory.php.</p></p>

<p>Im a noob please tell me if im dooing right.</p>
