Add this to the list of things every SharePoint developer should know (up there with disposing SPWebs and SPSites).

In general…

  1. Don’t update SharePoint objects on a GET request
  2. Call SPUtility.ValidateFormDigest() before anything on a POST request

Here are the two links to read:

Two identical custom lists with the same columns. The only difference is that one list has columns added using Site Columns and the other list had columns added directly to the list. The same? Not so much…
» Read more…