Security question

[nerbert]

That explains why they do it with REQUEST values but none of those links should work that way. Here's a "form link" as I call it :

<form action="some_file.php" method="post" id="someid"><input type="hidden" name="do" value="someaction">
<input type="hidden" name="securitytoken" value="{vb:raw bbuserinfo.securitytoken}" />
<a href="javascript:fetch_object('someid').submit()">{vb:rawphrase some _action}</a></form>

It looks like a normal link but it's not something you can post in a thread.