PHP Superglobals

Superglobals are built-in boxes of information that PHP keeps within reach everywhere, like a school bulletin board every room can see. They hold things like form data, cookies, and details about the visitor.

In this page:

What Are Superglobals?
$_SERVER and $GLOBALS
$_SESSION and $_COOKIE
$_FILES for Uploads
$_ENV and Security Considerations

Syntax

php

$_SERVER["KEY"];      // request and server info
$_GET["key"];
$_POST["key"];
$_SESSION["key"];     // after session_start()
$_COOKIE["key"];
$GLOBALS["variable_name"];

What Are Superglobals?

Superglobals are built-in PHP arrays that are automatically available in every scope — inside any function or class method — without needing to be passed in or declared global.

They exist to carry information about the current request, server environment, and session that any part of the application might need.

Example: What Are Superglobals?

php

<?php
function showUser() {
    $_SESSION['user'] = "Alice"; // no `global` needed
    echo $_SESSION['user'];
}
session_start();
showUser();
?>

$_SERVER and $GLOBALS

$_SERVER holds request and server metadata such as the requested URL (REQUEST_URI), the HTTP method, and headers.

$GLOBALS gives access to every variable declared in the global scope from inside a function, which is technically possible but generally avoided in favor of explicit parameters.

Example: $_SERVER and $GLOBALS

php

<?php
// Set `$_SERVER['REQUEST_URI']` to '/home'
$_SERVER['REQUEST_URI'] = '/home';
// Print `$_SERVER['REQUEST_URI'] . "\n"` to the output
echo $_SERVER['REQUEST_URI'] . "\n";

// Declare `$name`, set to "Alice"
$name = "Alice";
// Define the function `show` with no parameters
function show() {
    // Print `$GLOBALS['name']` to the output
    echo $GLOBALS['name'];
}
// Call `show()`
show();
?>

$_SESSION and $_COOKIE

$_SESSION stores data that persists across multiple requests from the same visitor, backed by a session ID usually stored in a cookie, and requires session_start() before use.

$_COOKIE reads the raw cookie values sent by the browser directly, without any server-side session logic involved.

Example: $_SESSION and $_COOKIE

php

<?php
// Call `session_start()`
session_start();
// Set `$_SESSION['user_id']` to `5`
$_SESSION['user_id'] = 5;
// Set `$_COOKIE['theme']` to 'dark'
$_COOKIE['theme'] = 'dark';
// Print `$_SESSION['user_id'] . " " . $_COOKIE['theme']` to the output
echo $_SESSION['user_id'] . " " . $_COOKIE['theme'];
?>

$_FILES for Uploads

$_FILES is populated whenever a form submits with enctype="multipart/form-data", giving you each uploaded file's temporary path, original name, size, and any upload error code — all of which should be validated before the file is moved anywhere permanent.

Example: $_FILES for Uploads

php

<?php
// Set `$_FILES['avatar']` to `['name' => 'pic.png', 'tmp_name' => '/tmp/xyz', 'error' => 0]`
$_FILES['avatar'] = ['name' => 'pic.png', 'tmp_name' => '/tmp/xyz', 'error' => 0];
// Check whether `$_FILES['avatar']['error'] === 0`
if ($_FILES['avatar']['error'] === 0) {
    // Print `"Upload OK: " . $_FILES['avatar']['name']` to the output
    echo "Upload OK: " . $_FILES['avatar']['name'];
}
?>

$_ENV and Security Considerations

$_ENV exposes environment variables the web server was started with, often used for secrets like database credentials so they never appear in source code.

Because every superglobal reflects untrusted external input except $_ENV and $GLOBALS, always validate before trusting their contents.

Example: $_ENV and Security Considerations

php

<?php
// Call `putenv("DB_PASSWORD=secret")`
putenv("DB_PASSWORD=secret");
// Print `getenv("DB_PASSWORD") . "\n"` to the output
echo getenv("DB_PASSWORD") . "\n";
// Print "Always validate superglobal input before trusting it" to the output
echo "Always validate superglobal input before trusting it";
?>

Chapter Quiz — Complete all 8 topics to unlock

0/8 topics done

Complete these topics first:

← Previous Lesson PHP User Input (HTML Forms) Next Lesson → PHP $_GET & $_POST