title: PHP Security: send POST to same URL = bad?
body: <p>I had a response on a question yesterday about sending POST data to the same page with the <a href="http://en.wikipedia.org/wiki/Post/Redirect/Get" rel="nofollow noreferrer">Post-Redirect-Get pattern</a> like this:</p>
  
  <pre><code>if (isset($_POST['Submit'])) {
      // prevent resending data
      header("Location: " . $_SERVER['PHP_SELF']);
  }
  </code></pre>
  
  <p>Someone replied: <a href="https://stackoverflow.com/questions/4016968/sending-data-to-same-php-page-from-javascript-no-ajax-or-forms">sending data to same PHP page from Javascript, no AJAX or forms</a></p>
  
  <blockquote>
    <p>It is extremely important for the purposes of web security that a POST cannot be sent via a simple URL.</p>
  </blockquote>
  
  <p>Now I would like to know what is wrong with this? I want to avoid using a separate page with the confirmation message, because it just breaks the user experience and from a design POV it is a no-go.</p>