What is the difference between GET and POST, and how do you handle form input securely in PHP?

GET sends data in the URL query string. It is visible, bookmarkable, logged by servers and proxies, cached, and length-limited. Use it for retrieving — searches, filters, pagination — because repeating it must be safe.

POST sends data in the request body. It is not in the URL, not cached by default, and effectively unlimited in size. Use it for anything that changes state.

Note: POST is not secure by itself. Both are plaintext without HTTPS. The reason not to put a password in a GET request is that it lands in browser history and server logs, not that POST is encrypted.

Handling input securely — the layers:

• Validate on the server, always. Client-side validation is a convenience, not a control. Check type, length, format, and range with filter_var or a validation library.
• Escape at the point of use, differently for each context. Prepared statements for SQL; htmlspecialchars($v, ENT_QUOTES, 'UTF-8') for HTML output; json_encode for JavaScript. There is no single sanitising function that makes input universally safe.
• Use a CSRF token on every state-changing form, compared with hash_equals.
• For file uploads, verify the real MIME type rather than trusting the extension, cap the size, rename the file, and store it outside the web root.