Superglobals: $_GET, $_POST, and $_SERVER
How PHP exposes incoming request data through built-in superglobal arrays.
What you'll learn
- Explain what `$_GET`, `$_POST`, and `$_SERVER` represent for an incoming request
- Safely read a possibly-missing key from a superglobal array using `??`
- Predict the output of code reading request data with fallback defaults
Explanation
PHP automatically populates several special, always-available arrays -- called superglobals -- from the incoming HTTP request, before your script's first line even runs. $_GET holds query-string parameters (from a URL like page.php?name=Ada&lang=en, PHP fills $_GET["name"] and $_GET["lang"] for you). $_POST holds form-body data submitted via an HTTP POST request. $_SERVER holds metadata about the request and server environment, like $_SERVER["REQUEST_METHOD"] ("GET" or "POST", among others).
Because request data is fundamentally untrusted input, reading a key that a visitor simply didn't supply is common and expected -- it does not throw an error, but accessing a genuinely undefined array key directly does raise a warning in modern PHP. The idiomatic guard is the null coalescing operator ??: $_GET["name"] ?? "Guest" evaluates to the query parameter's value if it's set, or "Guest" otherwise, with no warning either way.
The lab below assigns directly into $_GET purely to illustrate what reading it looks like -- in a real request, PHP populates $_GET for you automatically from the URL's query string; you never assign to it yourself in ordinary request-handling code.
Reading superglobals safely is the first half of handling user input responsibly; the second half -- never trusting that data blindly when it reaches a database query or HTML output -- is covered in this course's security lesson.
Guided lab
Predict: Reading request data safely
This illustrates reading request data as PHP would populate it for a request to greet.php?name=Ada&lang=en (the assignments below simulate what PHP fills in automatically). Predict the output.
<?php
// Simulating what PHP populates automatically for a request to
// greet.php?name=Ada&lang=en -- you would not assign these yourself.
$_GET["name"] = "Ada";
$_GET["lang"] = "en";
$name = $_GET["name"] ?? "Guest";
$lang = $_GET["lang"] ?? "en";
$theme = $_GET["theme"] ?? "light";
echo "Hello, $name! (lang=$lang, theme=$theme)\n";
echo "Request method: " . ($_SERVER["REQUEST_METHOD"] ?? "GET") . "\n";Stuck? Get a hint.
Common mistakes
- Reading `$_GET["key"]` directly without `??` or `isset()`, and getting a warning (or an unintended `null`) when a visitor's request simply doesn't include that parameter.
- Assuming form data submitted via POST shows up in `$_GET` -- it doesn't; POST body data lands in `$_POST`, query-string data lands in `$_GET`.
- Trusting `$_GET`/`$_POST` values as already safe to use in a database query or HTML output -- superglobals hold raw, untrusted visitor input.
Knowledge check
Takeaway
Read superglobals with `??` (or `isset()`) rather than directly, since request data a visitor didn't supply is the normal case, not an error.
Summary
`$_GET`, `$_POST`, and `$_SERVER` are automatically populated from the incoming request; missing keys are expected and should be guarded with `??` rather than accessed directly.
References
Your notes
Notes save automatically.
Finished this lesson?
Mark it complete to track your progress and schedule a future review.
AI tutor
The optional AI tutor isn't enabled in this deployment. All lessons, exercises, quizzes, and search work fully without it.