PHP $_REQUEST Superglobal — PHP

PHP $_REQUEST

The $_REQUEST superglobal contains data from submitted forms, URL query strings, and HTTP cookies.

In other words, the $_REQUEST superglobal is an array containing data from $_GET, $_POST, and $_COOKIE superglobals.

PHP superglobals are built-in variables that are always accessible in all scopes!

You access the data with the $_REQUEST keyword followed by the name of the form field, query parameter, or cookie.

Note: Because $_REQUEST can combine data from different sources (GET, POST, and COOKIE), it can introduce security vulnerabilities if not handled carefully. So, while using $_REQUEST can be convenient, it is more recommended to use the more specific $_GET, $_POST, and $_COOKIE superglobals when possible.

Using $_REQUEST on POST Request

Here we will use the $_REQUEST superglobal to access data submitted via a POST request.

POST request are usually data submitted from an HTML form.

The HTML form must have the method attribute set to "post" and include input fields with name attributes. The name attribute is used as the key to access the data in the PHP script.

Here is an example of how a HTML form could look like:

HTML file:

html

<html>
<body>

<form method="post" action="demo_request.php">
  Name: <input type="text" name="fname">
  <input type="submit">
</form>

</body>
</html>

When a user clicks the submit button, the form data is sent to the PHP file specified in the action attribute of the <form> tag.

In the PHP file we can use the $_REQUEST variable to collect the value of the input field.

PHP file:

php

$name = htmlspecialchars($_REQUEST['fname']);
echo $name;

Note: Always validate and sanitize all data collected from superglobals like $_REQUEST before using it, to prevent security vulnerabilities like XSS attacks. The htmlspecialchars() function used above is one way to do it. More robust filtering can be done by using the PHP filter functions.

In the example below we have put the HTML form and PHP code in the same PHP file:

Example

php

<html>
<body>

<form method="post" action="<?php echo $_SERVER['PHP_SELF'];?>">
  Name: <input type="text" name="fname">
  <input type="submit">
</form>

<?php
if ($_SERVER["REQUEST_METHOD"] == "POST") {
  $name = htmlspecialchars($_REQUEST['fname']);
  if (empty($name)) {
    echo "Name is empty";
  } else {
    echo $name;
}
?>

</body>
</html>

Using $_REQUEST on GET Request

GET request can be form submissions as in the example above, with the method attribute of the <form> element is set to "get".

GET requests can also be data from a URL query string (information added in URL address).

Here is an example of how an HTML link with a URL query string could look like:

HTML link with URL query parameters:

html

<html>
<body>

<a href="demo_phpfile.php?subject=PHP&web=example.com">Test $GET</a>

</body>
</html>

When a user clicks the link, the query string data is sent to demo_phpfile.php.

In the PHP file we can use the $_REQUEST variable to collect the value of the query string.

Example

The PHP file demo_phpfile.php:

php

<html>
<body>

<?php
$subject = htmlspecialchars($_GET['subject']);
$web = htmlspecialchars($_GET['web']);
echo "Study $subject at $web.";
?>

</body>
</html>