BeingXpert Learn & Build Future

17. PHP Superglobals

What you will learn

  • What superglobals are
  • How to read data from the address with $_GET
  • How to read form data with $_POST
  • Useful values in $_SERVER
  • Why all of this data must be treated as untrusted

What is a superglobal?

A superglobal is a built-in variable that PHP fills in for you. It is available everywhere, including inside functions, without any special keyword. All of them start with an underscore and are written in capital letters.

Variable Holds
$_GET Values sent in the address (the query string)
$_POST Values sent by a form that uses method="post"
$_SERVER Information about the request and the server
$_COOKIE Cookies sent by the browser
$_SESSION Data kept between page visits (covered in a later lesson)
$_FILES Details of uploaded files
$_REQUEST A mix of GET, POST, and cookie data. Avoid it

Each one is an associative array, so you read it with a key, such as $_GET["name"].

$_GET: data in the address

Anything after a ? in the address is the query string. Pairs look like key=value and are joined with &.

PHP code: greet.php

<?php
$name = $_GET["name"] ?? "guest";

echo "Hello, " . htmlspecialchars($name, ENT_QUOTES, "UTF-8") . "!";

Output for each address

/practice/greet.php shows: Hello, guest!

/practice/greet.php?name=Sam shows: Hello, Sam!

The ?? gives a fallback when the key is missing, so there is no warning. Notice htmlspecialchars(): the visitor controls the address, so anyone could put HTML in name.

Several values

PHP code: lesson.php

<?php
$course = $_GET["course"] ?? "html";
$page = (int) ($_GET["page"] ?? 1);

echo "Course: " . htmlspecialchars($course, ENT_QUOTES, "UTF-8") . ", page: " . $page;

Output for /practice/lesson.php?course=css&page=3

Course: css, page: 3

Everything in $_GET arrives as text, so the page number is converted with (int).

$_POST: data from a form

$_POST holds values from a form sent with method="post". Unlike $_GET, the values are not shown in the address. You will build real forms in the next lesson.

PHP code

<?php
if ($_SERVER["REQUEST_METHOD"] === "POST") {
    $email = trim($_POST["email"] ?? "");
    echo "You sent: " . htmlspecialchars($email, ENT_QUOTES, "UTF-8");
}

GET or POST?

GET POST
Where the data goes In the address In the body of the request
Can be bookmarked or shared Yes No
Use for Searching, filtering, page numbers Logins, messages, anything that changes something
Private data (passwords) Never Yes, over HTTPS

POST is not encryption. It only keeps the data out of the address bar and browser history. Use HTTPS on a live site to protect data on its way to the server.

$_SERVER: facts about the request

PHP code

<?php
echo "Method: " . $_SERVER["REQUEST_METHOD"] . "<br>";
echo "Script: " . htmlspecialchars($_SERVER["SCRIPT_NAME"], ENT_QUOTES, "UTF-8") . "<br>";
echo "Has HTTPS: " . (!empty($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] !== "off" ? "yes" : "no");

Output when opened on your LocalWP site (yours may differ)

Method: GET
Script: /practice/server.php
Has HTTPS: no

Key Meaning
REQUEST_METHOD GET or POST
SCRIPT_NAME The path of the running script
QUERY_STRING The part after the ?
HTTP_USER_AGENT The visitor’s browser, as they report it

Some $_SERVER values, such as HTTP_USER_AGENT and HTTP_REFERER, are sent by the visitor, so they can be faked. Treat them as untrusted.

Safer reading with filter_input

filter_input() reads a value and validates it in one step. It returns null when the key is missing and false when validation fails.

PHP code

<?php
$page = filter_input(INPUT_GET, "page", FILTER_VALIDATE_INT);

if ($page === null || $page === false || $page < 1) {
    $page = 1;
}

echo "Showing page " . $page;

Output for ?page=abc, ?page=4, and no page

?page=abc shows: Showing page 1
?page=4 shows: Showing page 4
no page shows: Showing page 1

Never trust superglobal data

Everything in $_GET, $_POST, $_COOKIE, and $_FILES comes from the visitor, and can be changed by anyone, including with tools that never use your form. Follow three rules:

  1. Validate it before you use it: right type, length, and allowed values.
  2. Escape it before you print it: htmlspecialchars().
  3. Never put it straight into a database query or a file path. You will learn how to do that safely later in this course.

Common mistakes

  • Reading $_POST["name"] without checking it exists.
  • Printing values without htmlspecialchars().
  • Sending passwords with GET.
  • Using $_REQUEST, which hides where data came from.
  • Forgetting that all incoming values are strings.

Exercise

Write a page that reads ?city=... from the address and prints You chose: followed by the city, or You chose: nowhere if none is given. Make the output safe.

Show solution 
<?php
$city = $_GET["city"] ?? "nowhere";

echo "You chose: " . htmlspecialchars($city, ENT_QUOTES, "UTF-8");

Test it with ?city=Lahore, with no query, and with ?city=<b>x</b>. The last one should show the tags as plain text.

Knowledge check

1. Which superglobal holds values from the address after the ??

$_GET

2. Which method should a login form use?

POST (over HTTPS).

3. What should you do before printing a value from $_GET?

Escape it with htmlspecialchars().

Summary

  • Superglobals such as $_GET, $_POST, and $_SERVER are available everywhere.
  • GET is for lookups, and POST is for changes. Neither is private without HTTPS.
  • All incoming data is untrusted text. Validate it and escape it on output.
Scroll to Top