I'm currently a developer making my first foray into web development, mostly using C# ASP.NET services such as MVC and Web API. Getting into the HTTP side of things, I'm currently deciding whether or not to be using POST or GET when accessing my data models.
Obviously, I would be using POST when my repository layer is communicating with data sources, but when surmising how my controller will be parsing input from the user (with this being a front-facing web app), I became unnerved thinking about passing somewhat sensitive information values over HTTP GET, seeing as they would be entered through the URL. Remembering in education how much the dangers of SQL injection were beat into us, I have an (unfounded) hunch that I should only be using POST when going to my repository that communicates with my databases.
Am I correct in assuming there are valid security concerns with using HTTP GET to send parameters to a repository layer that communicates with my databases?
Naturally, I would be enforcing validation on both ends, but it feels to me that GET has a broader range of attack than POST. I would like my validation to be narrow and strict.