PHP Superglobals

PHP Superglobals: Predefined Global System Variables

Superglobals are built-in array variables in PHP that are always available in all scopes throughout a script without requiring global $variable; declarations.

List of PHP Superglobals

Superglobals Request Pipeline

flowchart LR
    A["HTTP Request"] --> B["Web Server Processing"]
    B --> C["$_SERVER (Headers & IP)"]
    B --> D["$_GET (Query Params)"]
    B --> E["$_POST / $_FILES (Body & Uploads)"]
    B --> F["$_COOKIE (Browser Cookies)"]
    C & D & E & F --> G["PHP Application Logic"]

Practical Code Example

<?php
declare(strict_types=1);

// Inspect Server & Client Request Metadata
$clientIP = $_SERVER['REMOTE_ADDR'] ?? '127.0.0.1';
$requestMethod = $_SERVER['REQUEST_METHOD'] ?? 'GET';
$requestURI = $_SERVER['REQUEST_URI'] ?? '/';
$userAgent = $_SERVER['HTTP_USER_AGENT'] ?? 'Unknown';

// Safely Retrieve URL Query Parameter (?search=laravel)
$searchTerm = filter_input(INPUT_GET, 'search', FILTER_SANITIZE_SPECIAL_CHARS) ?? '';

echo "=== Request Audit Log ===
";
echo "HTTP Method: $requestMethod
";
echo "Request URI: $requestURI
";
echo "Client IP: $clientIP
";
echo "Search Term Parameter: '$searchTerm'
";

Best Practices

• Never Trust Superglobal Input Directly: Always sanitize and validate values using filter_input() or explicit sanitization routines before using them.
• Avoid Using $_REQUEST: Explicitly inspect $_GET or $_POST depending on expected HTTP verb to prevent CSRF and parameter pollution vulnerabilities.
• Use filter_input(INPUT_POST, 'key') over Direct $_POST['key']: Protects against undefined array key notices when variables are missing.

Self-Check Challenge

Write a code snippet that uses filter_input(INPUT_GET, 'page', FILTER_VALIDATE_INT) to safely retrieve an integer page parameter with a default fallback of 1!