Go look at the page. You'll see, amongst other things, that there are some hidden fields that you left out. I ran a form parsing script on the page and received the following output:

my $tainted_selection    = $q->param( 'Selection' )    || ''; # select
my $tainted_urbanization = $q->param( 'urbanization' ) || ''; # hidden
my $tainted_firm         = $q->param( 'firm' )         || ''; # hidden
my $tainted_address      = $q->param( 'address' )      || ''; # hidden
my $tainted_address1     = $q->param( 'address1' )     || ''; # text
my $tainted_address2     = $q->param( 'address2' )     || ''; # text
my $tainted_city         = $q->param( 'city' )         || ''; # text
my $tainted_state        = $q->param( 'state' )        || ''; # select
my $tainted_zipcode      = $q->param( 'zipcode' )      || ''; # text
my $tainted_submit       = $q->param( 'Submit' )       || ''; # image
[download]

A quickly constructed query string based upon that data succeeded with the warning that they couldn't find the fake address:

http://www.usps.com/zip4/zip4_response.jsp?Selection=1&urbanization=&f
+irm=&address=&address1=222%20Washington%20Drive&address2=&city=Portla
+nd&state=OR&zipcode=&97212
[download]

However, as soon as I left out the hidden "urbanization" field, the script generated an error. Admittedly, this is poor programming on their part, but it you had viewed the source of their HTML, you probably would have caught this.

Cheers,
Ovid

Join the Perlmonks Setiathome Group or just click on the the link and check out our stats.