php web service method post - php

Question

hi i have a php web that return json data usin json!encode but when i change it from GET to POST it return null
<?php
header('Content-Type: application/json; charset=utf-8');
include('settings.php');
mysql_connect($host,$user,$password);
mysql_select_db($base);
mysql_query('SET CHARACTER SET utf8');
$login = $_GET['login'];
$password = $_GET['password'];
$req = "select * from user WHERE username = '".$login."' and password = '".$password."'";
$sql=mysql_query($req);
$nn=mysql_num_rows($sql);
$items = array("items" => NULL);
while ($data=mysql_fetch_array($sql))
{
$items["items"][] = array(
"id" => $data['id'],
"username" => $data['username'],
"password" => $data['password'],
"nom_prenom" => $data['nom_prenom'],
"nom_prenom_arabe" => $data['nom_prenom_arabe'],
"specialite" => $data['specialite'],
"specialite_arabe" => $data['specialite_arabe'],
"adresse" => $data['adresse'],
"adresse_arabe" => $data['adresse_arabe'],
"telephone_cabinet" => $data['telephone_cabinet'],
"gsm" => $data['gsm'],
);
}
echo json_encode($items,JSON_UNESCAPED_UNICODE);
?>
it returns
{"items":[{"id":"2","username":"**","password":"*","nom_prenom":"****","nom_prenom_arabe":"مهذب عبد الصمد ","specialite":"Pediatrie","specialite_arabe":"إختصاصي في الامراض النفسية و العصبية","adresse":"Av tahar sfar imm .El BARAKA sousse 4000","adresse_arabe":" 4000 شارع طاهر سفر عمارة البركة سوسة","telephone_cabinet":"73698521","gsm":"25631478"}]}
but with
$login = $_POST['login'];
$password = $_POST['password'];
it return
{"items":null}
can anyone explain to me why :) thanks

Answer 1

Because the post that invoke this page has a GET method , so remplace it with POST then it will work as expected.
another point is it's discouraged to use string concatenation when quering databases due to security risk. use prepared statements instead.

Answer 2

First of: For the love of.. Clear text password and no request validation?
Please before you do anything at all, read up about sql injections and why clear text is BAD, really really bad.
Now to you question.
The $_GET arrays contains query parameters ex (?test=test) on GET METHOD calls to the server. GET is the basic HTTP call and tells the server you want to read a page.
IN OLD TIME :
The $_POST array contains post parameters on POST METHOD calls. POST is used when you want to update or add information on the server. This is usually called from a html form.
W3School have a guide on HTTP Method calls here.
BUT NOW WITH AJAX AND THE NEW FEATURES OF HTML5 :
YOU CAN USE THE 'POST' TO GET DATA.
THE PROBLEM HERE IS THE SECURITY OF THE NAVIGATORS LIKE FIREFOX AND CHROME;
THE SOLUTION :
Modify the cors http : in the server PHP add this in first of your page php:
//Part added by ilyas :
if (isset($_SERVER['HTTP_ORIGIN'])) {
header("Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}");
header('Access-Control-Allow-Credentials: true');
header('Access-Control-Max-Age: 86400'); // cache for 1 day
}
//End of part.