<?php
// Simulating the getContent vs postContent behavior
// Both methods had the same vulnerability pattern:
// $code = $user->getPasswordRecoveryCode() overwrote user input
// 
// The fix applies to BOTH getContent() and postContent()
// So POST requests are also protected
?>