PHP $_GET & $_POST
In this page:
$_GET["key"]; // from the URL query string: page.php?key=value
$_POST["key"]; // from the request body of a submitted formUnderstanding $_GET
$_GET collects values appended to the URL as a query string (?search=php), which means the data is visible in the address bar, browser history, and server logs.
That visibility is a feature for shareable, bookmarkable pages like search results — and a liability for anything sensitive.
Example: Understanding $_GET
<?php
// Set `$_GET['search']` to "php"
$_GET['search'] = "php";
// Print `"Search query: " . $_GET['search']` to the output
echo "Search query: " . $_GET['search'];
?>Login to try C/C++/Java/PHP code in the editor
Understanding $_POST
$_POST carries its data in the HTTP request body instead of the URL, so it never appears in the address bar or gets cached in browser history.
That's why login forms, payment forms, and anything else handling sensitive data almost always use POST rather than GET.
Example: Understanding $_POST
<?php
// Set `$_POST['password']` to "secret123"
$_POST['password'] = "secret123";
// Print "Password never appears in the URL: " . strlen($_POST['password']) . " chars" to the output
echo "Password never appears in the URL: " . strlen($_POST['password']) . " chars";
?>Login to try C/C++/Java/PHP code in the editor
When to Use $_GET vs $_POST
As a rule of thumb: use $_GET for requests that only *read* data and are safe to bookmark or reload (search filters, pagination).
Use $_POST for anything that *changes* server state — creating an account, placing an order — where an accidental page reload shouldn't silently repeat the action.
Example: When to Use $_GET vs $_POST
<?php
// $_GET for reading/searching -- safe to bookmark
$_GET['page'] = 2;
// $_POST for actions that change state
$_POST['create_account'] = true;
echo "GET page: " . $_GET['page'];
?>Login to try C/C++/Java/PHP code in the editor
Safe $_GET Parameters
Because $_GET values live in the URL, a user can edit them directly in the address bar before the request even reaches your server — ?id=5 becomes ?id=6 with zero effort.
Never assume a $_GET value is the one your own links generated; validate and sanitize it exactly as you would any other user input.
Example: Safe $_GET Parameters
<?php
$_GET['id'] = "6"; // user could edit this in the address bar
$id = (int) $_GET['id'];
echo "Validated id: " . $id;
?>Login to try C/C++/Java/PHP code in the editor
Processing POST Forms
Before acting on a $_POST submission, confirm $_SERVER[REQUEST_METHOD] === POST (or check that the expected keys are actually set).
Skipping this check means a script written to expect a form submission can misbehave — or throw warnings — on a plain page load.
Example: Processing POST Forms
<?php
// Set `$_SERVER['REQUEST_METHOD']` to 'POST'
$_SERVER['REQUEST_METHOD'] = 'POST';
// Check whether `$_SERVER['REQUEST_METHOD'] === 'POST'`
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
// Print "Processing the submitted form." to the output
echo "Processing the submitted form.";
}
?>Login to try C/C++/Java/PHP code in the editor
- Sending passwords or other sensitive data with
$_GET, which places them in the URL, browser history and server logs. - Trusting
$_GET[id]directly in a database query, which allows SQL injection; validate it and use prepared statements. - Setting
method="post"in the form but reading$_GET, or the reverse, so the expected array is empty.
Chapter Quiz — Complete all 8 topics to unlock
0/8 topics done
Complete these topics first: