PHP Form: POST, GET and REQUEST Methods

When an HTML form is submitted, PHP puts the field values into superglobal arrays. Which one you read depends on the form’s method: $_GET for method="get", $_POST for method="post", and $_REQUEST for either. This snippet prints a first and last name from each of them.

It expects a form with two inputs named fname and lname. Put the code in the PHP file the form submits to.

<!-- PHP GET METHOD -->
<p>
<?php if(isset($_GET['fname']) && !empty($_GET['fname'])): ?>
    <b>First Name:</b> <?php echo htmlspecialchars($_GET['fname']); ?></br>
<?php endif; ?>

<?php if(isset($_GET['lname']) && !empty($_GET['lname'])): ?>
    <b>Last Name:</b> <?php echo htmlspecialchars($_GET['lname']); ?>
<?php endif; ?>
</p>

<!-- PHP POST METHOD -->
<p>
<?php if(isset($_POST['fname']) && !empty($_POST['fname'])): ?>
    <b>First Name:</b> <?php echo htmlspecialchars($_POST['fname']); ?></br>
<?php endif; ?>

<?php if(isset($_POST['lname']) && !empty($_POST['lname'])): ?>
    <b>Last Name:</b> <?php echo htmlspecialchars($_POST['lname']); ?>
<?php endif; ?>
</p>

<!-- PHP REQUEST METHOD -->
<p>
<?php if(isset($_REQUEST['fname']) && !empty($_REQUEST['fname'])): ?>
    <b>First Name:</b> <?php echo htmlspecialchars($_REQUEST['fname']); ?></br>
<?php endif; ?>

<?php if(isset($_REQUEST['lname']) && !empty($_REQUEST['lname'])): ?>
    <b>Last Name:</b> <?php echo htmlspecialchars($_REQUEST['lname']); ?>
<?php endif; ?>
</p>

How it works

• Each block checks that the field exists and isn’t empty before printing it, so a missing field doesn’t trigger a PHP warning. !empty() alone would do the same job, because empty() also returns true for a key that isn’t set.
• $_GET values come from the URL query string, for example ?fname=Jeff&lname=Smith. They’re visible and can be bookmarked, which suits searches and filters.
• $_POST values are sent in the request body and don’t appear in the URL. Use POST for forms that save data or contain passwords, and prevent resubmission when the page is refreshed so the data isn’t sent twice.
• $_REQUEST merges GET and POST values (and, depending on the server’s PHP settings, cookies). It’s convenient, but you can’t tell where a value came from, so the specific arrays are usually the better choice.

Escape before you print

Every value goes through htmlspecialchars() before it’s echoed. It turns characters such as <, >, & and quotes into HTML entities, so if someone puts HTML or JavaScript into the URL, the page shows it as text instead of running it. Printing the raw value would open a cross-site scripting (XSS) hole. Inside WordPress, esc_html() does the same job. For cleaning values before you use or store them, see these PHP form sanitization examples.

Related articles

• validating an uploaded image: file fields arrive in $_FILES, not $_POST