PHP Superglobals
Superglobals are arrays PHP populates automatically — request data, server info, cookies, sessions. Available in every scope without global.
The set
| Variable | Holds |
|---|---|
$_GET | Query-string params from the URL. |
$_POST | Form fields from a POST request. |
$_REQUEST | GET + POST + COOKIE merged (avoid; ambiguous). |
$_FILES | Uploaded files (with multipart forms). |
$_COOKIE | Cookies sent by the browser. |
$_SESSION | Per-user session store (after session_start()). |
$_SERVER | Request info: URL, headers, IP, user agent. |
$_ENV | Environment variables. |
$GLOBALS | All globals merged into one array. |
Reading request input safely
PHP
$name = trim($_POST['name'] ?? ''); $page = (int) ($_GET['page'] ?? 1); $theme = $_COOKIE['theme'] ?? 'light';
Handy $_SERVER keys
| Key | Value |
|---|---|
REQUEST_METHOD | 'GET', 'POST', … |
REQUEST_URI | '/users/42?tab=orders' |
HTTP_HOST | 'example.com' |
HTTPS | 'on' if TLS; empty otherwise |
REMOTE_ADDR | Client IP |
HTTP_USER_AGENT | Browser UA string |
HTTP_REFERER | Previous page (untrustworthy) |
Treat them as untrusted
Every superglobal except $_SESSION contains data from the user. Validate. Sanitise. Never interpolate straight into SQL or HTML.
Tip: Modern frameworks (Laravel, Symfony) wrap these in a
Request object with typed accessors and validation. New code: prefer the framework's Request over poking superglobals directly.Example
Example
<?php // Available everywhere — superglobals. print_r($_SERVER); print_r($_GET); print_r($_POST); print_r($_COOKIE); print_r($_SESSION ?? []); print_r($_ENV);Try it Yourself »
Exercise
Read a query-string parameter from…
$
_['page']
Three letters.
Discussion
Loading…