I did, indeed, not elaborate on the whole GET/POST topic – but hey – it’s for future use :) Especially if I get a chance to publish the security slides.

As for redirecting to a new form – the same URL can handle both AJAX, and non-AJAX (/myResource?delete=yes&confirmed=yes). Assuming you’re already doing a POST, you just need to check for AJAX header and return appropriate view – be it MVC or not – if (AJAX) { echo JSON() } else { echo HTML() } – not that much code required!

The only real thing to build is the “interstitial form” – but that can easily be frameworkified. In reality, supporting this is not even 10% overhead on individual feature, compared to the hoops that you have to implement for it to work (access checking, validation, escaping, connections, etc etc). And it’s even more negligible in the big picture of the overall project (whatever the case may be) – you need frameworks developed, etc etc.

There’s no reason to be lazy, whether client pays for it or not. If one starts doing that now, and charging their customers 5% more, without even negotiating the “accessibility” aspect – the “just do it” way – it’s still just just more than inflation in Ireland in 2008. And you get the bragging rights as well, even if the customer doesn’t realize that :)

Redirecting to a new form from the link to support regressive dehancement ;) is my favourite choice, also links are crawlable, URL’s don’t need to be maintained in server-side AND javascript etc. – but it means more coding, and the client won’t pay for that (time, not necessarily money). But that opens up the whole question of selling basic functionality to the business, which is always a hard sell – “gimme what I want, not what I need”