Everything with $_REQUEST

PHP course · Beginner · Lesson 98/116

Learn to receive GET, POST and cookie data together with $_REQUEST.

Everything with $_REQUEST

The $_REQUEST superglobal merges $_GET, $_POST and $_COOKIE by default. From one place you can reach URL, form and cookie data together.

The merge order follows the request_order php.ini setting; the default is 'GP', meaning GET first then POST overwrites it. When a key clashes, POST wins. In CLI $_REQUEST starts empty.

request_order and clashes

The request_order setting controls the merge order. The default 'GP' means POST writes over GET; 'GPC' lets the cookie win last.

So when the same key appears in both GET and POST, $_REQUEST shows the POST value under the default setting. For security, knowing the source matters; in doubt, using $_GET or $_POST directly is safer.

Exercise Safe access with a param function

Define a function named param; its first parameter is $key, the second is $default with a default value of empty string "". In the body write return $_REQUEST[$key] ?? $default;. Outside the function set $_REQUEST['page'] = "3";. Then call echo param('page') . "\n"; and echo param('missing', '1') . "\n";.

Show example solution

Define function param($key, $default = "") { return $_REQUEST[$key] ?? $default; }, set $_REQUEST['page'] = "3"; outside, then write echo param('page') . "\n"; and echo param('missing', '1') . "\n";.
Example solution:
<?php
// Define param and call it
$_REQUEST['page'] = "3";
function param($key, $default = "") {
    return $_REQUEST[$key] ?? $default;
}
echo param('page') . "\n";
echo param('missing', '1') . "\n";

Test yourself

Which three superglobals does $_REQUEST merge by default?
- $_GET + $_POST + $_FILES
- $_GET + $_POST + $_COOKIE
- $_GET + $_POST + $_SESSION
- $_POST + $_COOKIE + $_ENV
Show answer

$_GET + $_POST + $_COOKIE — Correct. $_REQUEST merges the $_GET, $_POST and $_COOKIE superglobals.
Match each superglobal to its source

$_GET

From URL
$_POST

From form body
$_COOKIE

From cookies
$_REQUEST

GET+POST+COOKIE

Complete the $_REQUEST access

$id = $_REQUEST[____] ?? 0;

Show answer

$id = $_REQUEST['id'] ?? 0;

Everything with $_REQUEST