I occasionally convert web form methods from POST to GET (the Firefox Web Developer Add-on makes this simple) for purposes of bookmarking the resulting page. Sometimes it turns out to be more entertaining than expected.
While bookmarking a USPS detailed tracking result, looking at the URL made me realize that the bookmark wouldn't actually do anything useful. Nearly all the text on the page was the result of long strings passed as parameters to the CGI script. While this works, it's not exactly the nicest way to do it, and hiding behind the POST method doesn't make it any better. But it does make it entertaining, as you can change the tracking results to your heart's content.
One other notable web form gaffe was one I discovered a few years ago on the State Farm website. I wanted to email my State Farm representative, but didn't have her email address. On a lark, I took a look her "contact me" web form link on the State Farm website, and sure enough, her encoded email address was being passed as a parameter. Then I got curious, and tried passing other addresses to their web form. Sure enough, no input validation was being done, and their web form was effectively an open mail relay. I'm not sure if it's still like this, but it would be a fun hack to whip up a Perl SMTP server to take advantage of their generous relaying service.
So, in that spirit, click to view this weblog post on the USPS tracking results page.
