Comment by trulyme

Why only POST? Query params can be "hidden" in a similar way too, is there a reason GET requests are not vulnerable? Url length limit maybe?