When building a simple web app with database delete functionality, you normally would take the following steps:
- User initiates a GET request using a delete link
- User confirms the deletion
- Upon confirmation, browser initiates a POST request to the server to perform the deletion
What are the reasons for this convention? I understand that it sets up a confirmation step which would prevent automated calling of the delete function (as with spiders and such) - are there other reasons?