Fetching data from forms
When showing information in a URL, the risk of being attacked is low. This is because the visitor has no way to send data to our site – data could be injected only by URL and Joomla! performs good cleaning on the URLs that are processed with its router.
The problem arises when we include interaction in our developments, usually adding forms to the pages. Forms are quite common, even for pages that are meant to show information such as data listings. If you remember our Projects view, we added a search form and pagination to easily search the projects in our database. Those features are forms. This can be seen in the following extract of the layout for the projects listing in the backend (at src/component/admin/tmpl/projects/default.php):
<form action="<?php echo Route::_('index.php?
option=com_spm&view=projects'); ?>" method="post"
name="adminForm" id="...