PHP Superglobals

PHP Superglobals: Accessing HTTP Request and Server Data

PHP superglobals are built-in associative arrays that are always accessible in every scope—inside functions, classes, and templates—without needing the global keyword. They expose incoming URL query parameters, form submissions, cookies, session data, and server headers.

Overview of Built-In PHP Superglobals

Each superglobal captures a distinct layer of the HTTP request lifecycle.

<?php
declare(strict_types=1);

$method = $_SERVER['REQUEST_METHOD'] ?? 'CLI';
$page = filter_var($_GET['page'] ?? 1, FILTER_VALIDATE_INT, [
    'options' => ['default' => 1, 'min_range' => 1],
]);

echo "HTTP Method: {$method}" . PHP_EOL;
echo "Requested Page: {$page}" . PHP_EOL;

Treating Superglobals as Untrusted Input

Never trust values inside $_GET, $_POST, $_COOKIE, or HTTP header keys in $_SERVER (like HTTP_USER_AGENT). Anyone can tamper with them using curl or browser developer tools.

• Validate types with filter_var() or explicit casting.
• Escape values with htmlspecialchars() before rendering HTML.
• Bind values into SQL prepared statements instead of concatenating strings.

Common Mistakes to Avoid

• Using $_REQUEST instead of $_GET or $_POST: $_REQUEST merges query, post, and cookie data, hiding where the input actually came from. Always read $_GET or $_POST explicitly.
• Trusting $_SERVER['HTTP_HOST'] blindly: Clients can spoof the Host header. Validate against an allowlist of domains when building password-reset links.
• Printing $_GET without ??: Reading $_GET['search'] directly throws an undefined key warning when ?search= is omitted from the URL.

Frequently Asked Questions

Why should I avoid $GLOBALS in modern PHP?

Reading and mutating $GLOBALS hides dependencies and breaks encapsulation. Pass arguments into functions and return values explicitly instead.

Where does $_SERVER['REQUEST_URI'] come from?

The web server (Nginx, Apache, or PHP's built-in server) populates $_SERVER before running your script, giving you the requested path and query string.

Is $_POST populated when a client sends JSON (application/json)?

No. $_POST only parses application/x-www-form-urlencoded and multipart/form-data. Read JSON payloads using json_decode(file_get_contents('php://input'), true).