GET and POST in IIS logs

[gchen]

Is it true IIS log will have complete params list if the form method is GET while no parms being logged if the method used is POST.

Or it has to do with IIS log configuration?

Thanks a bunch!

 

[ChrisHirst]

the IIS log will record the URI used to access the page, if it includes parameters (as it would with a GET) they will be stored.


Chris.

Indifference will be the downfall of mankind, but who cares?
Woo Hoo! the cobblers kids get new shoes.
People Counting Systems

So long, and thanks for all the fish.

 

[gchen]

Do you know of any draw back of using GET instead of POST?

Thanks!

 

[ChrisHirst]

In what respect?



Chris.

Indifference will be the downfall of mankind, but who cares?
Woo Hoo! the cobblers kids get new shoes.
People Counting Systems

So long, and thanks for all the fish.

 

[gchen]

Well, what i meant to ask is what's the difference between POST and GET in terms of cgi scripts. Can i call the same cgi script, written in PERL or ASP, using POST or GET freely without any difference on the result except the query sstring being logged by GET and not logged by POST.

Thanks!

 

[ChrisHirst]

POST uses the form data to pass the parameters while a GET is transfered via the querystring.

If you use request("name") to gather the data either method will work.

Just be aware that anything sent via querystring can be manipulated easily so it should be processed and verified to avoid injection attacks etc.

Chris.

Indifference will be the downfall of mankind, but who cares?
Woo Hoo! the cobblers kids get new shoes.
People Counting Systems

So long, and thanks for all the fish.

 

[gchen]

hi Chris,

Thanks a lot! I need to analyze which value of query being submitted the most and this is an internal intranet thing, so i think i will go with GET.

All your inputs and answers are great and i really appreciated.

Have a nice weekend!

Gary

 

[bigoldbulldog]

There are some third party 'IIS analyze' tools on the market. I don't use them so I can't be of much help.

If you don't mind doing analysis on IIS itself, you could always write your own ISAPI filter so you can analyze both GET and POST data coming in to your website regardless of the page name/application name. This will be in C++/ATL Server.

If your site is small you could do something that will do similar. Write is separate and include it in the pages you need. Then the usual code, e.g. ASP:

For each item in Request.QueryString
' ...
Next

For each item in Request.Form
' ...
Next

' If used, then possibly
For each item in Session.Contents
' ...
Next

' And if your curious
For each item in Request.ServerVariables
' ...
Next

Then do your analysis and write it all to a database or file somewhere.

Cheers,
ND