PHP $_REQUEST

Data can reach a PHP script from a submitted form, from the query string in a URL, or from an HTTP cookie. $_REQUEST gathers all of it in one place.

Put another way, this superglobal is a single array built from the contents of $_GET, $_POST and $_COOKIE.

Like every superglobal, it is built in and you can use it from any scope.

To read a value, use the name of the form field, query parameter or cookie as the key in $_REQUEST.

Note: Mixing GET, POST and COOKIE data in one array is handy, but careless use can open security holes. When you can, prefer the more specific $_GET, $_POST or $_COOKIE.

Using $_REQUEST on POST Request

Let's start with data that arrives in a POST request and read it through $_REQUEST.

A POST request usually comes from an HTML form.

That form needs two things: its method attribute set to post, and input fields that have name attributes. Each field's name becomes the key your PHP script uses to find the value.

You can see such a form in the HTML Form snippet on this page.

Pressing the submit button sends the data to whichever PHP file the <form> tag names in its action attribute.

That file can then pull the typed value out of $_REQUEST, as the PHP File snippet shows.

Note: Never trust what comes out of a superglobal such as $_REQUEST. Validate and sanitize it first, so you don't leave the door open to attacks like XSS. Calling htmlspecialchars(), as the code here does, is one way; the PHP filter functions give you stronger filtering.

The example that follows keeps the form and its PHP code together in one PHP file:

POST Request With $_REQUEST

Read the input field with $_REQUEST once the form has been submitted:

Write a PHP script with an HTML form using method post that submits to itself. The form has a text input named "fname". When submitted, use $_REQUEST to get the value, sanitize it with htmlspecialchars(), and display it.
> Output: PHP script

Prompt

Write a PHP script with an HTML form using method post that submits to itself. The form has a text input named "fname". When submitted, use $_REQUEST to get the value, sanitize it with htmlspecialchars(), and display it.

Output: PHP script

<html>
<body>

<form method="post" action="<?php echo $_SERVER['PHP_SELF'];?>">
  Name: <input type="text" name="fname">
  <input type="submit">
</form>

<?php
if ($_SERVER["REQUEST_METHOD"] == "POST") {
  $name = htmlspecialchars($_REQUEST['fname']);
  if (empty($name)) {
    echo "Name is empty";
  } else {
    echo $name;
  }
}
?>

</body>
</html>

HTML Form

A simple form whose method is set to post:

<html>
<body>

<form method="post" action="demo_request.php">
  Name: <input type="text" name="fname">
  <input type="submit">
</form>

</body>
</html>

PHP File

The PHP side, reading the submitted value from $_REQUEST:

<?php
$name = htmlspecialchars($_REQUEST['fname']);
echo $name;
?>

Using $_REQUEST on GET Request

A GET request can come from a form too, when the method attribute of its <form> element is get.

It can also come from a query string, which is extra information added to a URL.

The HTML link snippet on this page carries a query string like that.

Clicking the link passes the query string data along to demo_phpfile.php.

Inside that file, the values can be read with $_REQUEST, and also with $_GET, which is what the example uses.

GET Request With $_REQUEST

The PHP file demo_phpfile.php:

Write a PHP script that uses $_GET to collect the values of "subject" and "web" from the URL query string and echoes a message using those values.
> Output: PHP script

Prompt

Write a PHP script that uses $_GET to collect the values of "subject" and "web" from the URL query string and echoes a message using those values.

Output: PHP script

<html>
<body>

<?php
$subject = htmlspecialchars($_GET['subject']);
$web = htmlspecialchars($_GET['web']);
echo "Study $subject at $web.";
?>

</body>
</html>

HTML Link With Query String

A link that passes two parameters in its query string:

<html>
<body>

<a href="demo_phpfile.php?subject=PHP&web=PromptCookbook">Test $GET</a>

</body>
</html>