Superglobals: $_GET, $_POST, and $_SERVER

Course 1 · Ch 8

Reading data that comes from outside your script — the URL, a submitted form, and the request itself

Every PHP script so far has run in isolation, with all its data defined inside the file itself. Real web pages need to receive information from the outside world — a search box's typed text, a login form's fields, which page a link was clicked from. PHP hands you this information through a set of special, automatically-populated arrays called superglobals — available in every scope, with no global keyword needed to reach them.

$_GET — Data in the URL

When a URL contains a query string like page.php?name=Sam&age=7, PHP automatically parses everything after the ? into the $_GET array.

// URL: page.php?name=Sam&age=7

<?php
  echo $_GET['name'];  // "Sam"
  echo $_GET['age'];   // "7" — note: always a string, even though it looks numeric
?>

Everything from $_GET and $_POST arrives as a string

Even age=7 in the URL comes through as the string "7", not the integer 7. If you're going to do arithmetic with it, cast it explicitly first — (int) $_GET['age'] — the same type-juggling behaviour from Chapter 2 applies here too, since PHP will still happily compare "7" == 7 as true, but won't automatically treat it as a true int everywhere.

$_POST — Data From a Submitted Form

A form using method="post" sends its field values in the request body rather than the URL — appropriate for anything longer, more sensitive, or that shouldn't sit visibly in a browser history or bookmark. PHP parses these into $_POST the same way it parses $_GET.

<!-- A simple HTML form -->
<form method="post" action="process.php">
  <input type="text" name="username">
  <input type="submit">
</form>

// process.php
<?php
  $name = $_POST['username'];
  echo "Hello, " . $name . "!";
?>

Handling a Missing Key Safely

Accessing $_GET['name'] when no name parameter was actually sent triggers an "undefined array key" warning and evaluates to null. Since user input is never guaranteed to include every field you expect, always check first.

<?php
  // Safe pattern using isset()
  $name = isset($_GET['name']) ? $_GET['name'] : 'Guest';

  // Cleaner equivalent using the null coalescing operator
  $name = $_GET['name'] ?? 'Guest';

  echo "Hello, " . $name;
?>

The ?? null coalescing operator returns its left-hand value if it exists and isn't null, otherwise it falls back to the right-hand default — a compact replacement for the longer isset() ? ... : ... pattern, and the standard, idiomatic way to safely read superglobal data in modern PHP.

$_SERVER — Information About the Request Itself

$_SERVER is populated automatically by PHP with details about the server environment and the current request — no form or URL parameter needed to fill it.

<?php
  echo $_SERVER['REQUEST_METHOD'];  // "GET" or "POST"
  echo $_SERVER['PHP_SELF'];       // the currently executing script's own path
  echo $_SERVER['HTTP_USER_AGENT']; // the visitor's browser identification string
?>

A very common pattern is branching behaviour based on REQUEST_METHOD — showing a blank form on a first, plain GET visit to a page, then processing the submitted data only once the same page receives a POST:

<?php
  if ($_SERVER['REQUEST_METHOD'] === 'POST') {
      $name = $_POST['username'] ?? '';
      echo "Thanks, " . $name;
  } else {
      echo '<form method="post"><input name="username"><input type="submit"></form>';
  }
?>

$_GET, $_POST, and $_SERVER are still ordinary arrays

Every array function from Chapter 6 works on them directly — count($_GET) tells you how many query parameters arrived, array_keys($_POST) lists every submitted field name, and a foreach loop can walk through every value in either without knowing the field names in advance.

Superglobal	Populated from
$_GET	Query string parameters in the URL (?key=value)
$_POST	Submitted form fields, when method="post"
$_SERVER	Request/environment info (method, script path, headers)
$_SERVER['REQUEST_METHOD']	"GET" or "POST" for the current request

Coding Challenges

Challenge 1

Simulate a $_GET array manually (since you're not running this through a real web server yet) with keys "product" and "qty". Safely read both using the ?? operator with sensible defaults, and echo a formatted sentence using the values.

📄 View solution

Challenge 2

Write a small script that checks $_SERVER['REQUEST_METHOD']. If it equals "POST", echo a thank-you message using a simulated $_POST['email'] value; otherwise, echo a message telling the visitor to submit the form first.

📄 View solution

Challenge 3

Given a simulated $_POST array representing a contact form (name, email, message — but with "email" deliberately missing), loop over $_POST with foreach and print_r any keys that are empty or missing, using isset() to check each expected field safely.

📄 View solution

Chapter 8 Quick Reference

$_GET — data from a URL's query string; always strings
$_POST — data from a submitted form using method="post"
$_SERVER — info about the request itself (method, script path, headers)
?? (null coalescing) — the safe, idiomatic way to read a superglobal key that might not exist
$_SERVER['REQUEST_METHOD'] — the standard way to branch between "show the form" and "process the form" on the same page
Next chapter: splitting code across multiple files with include and require