Superglobals and Form Handling

Everything a web request carries — form fields, URL query parameters, cookies, uploaded files — arrives in PHP through a set of built-in arrays called superglobals, available in every scope without needing global or a parameter.

$_GET and $_POST

<?php
// URL: /search.php?query=php+course
echo $_GET['query']; // "php course"

<form action="/login.php" method="post">
  <input type="text" name="username" />
  <input type="password" name="password" />
  <button type="submit">Log in</button>
</form>

<?php
// login.php
$username = $_POST['username'];
$password = $_POST['password'];

$_GET holds URL query-string parameters; $_POST holds data submitted from a form using method="post". Both are associative arrays keyed by each field's name attribute — matching the name in the HTML form is what makes a field show up as a particular key.

Never trust $_GET/$_POST directly

<?php
$email = $_POST['email'] ?? '';

if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    echo "Invalid email address.";
    exit;
}

Every value in $_GET and $_POST is raw, unvalidated input from a client you don't control — always validate it before use, and never pass it directly into a database query or output it into HTML without escaping (both covered in the security lesson). ?? guards against the key not existing at all, which happens whenever a form field was left blank or the request wasn't a real form submission.

$_SERVER: information about the request itself

<?php
echo $_SERVER['REQUEST_METHOD']; // "GET" or "POST"
echo $_SERVER['HTTP_USER_AGENT'];
echo $_SERVER['REQUEST_URI'];

$_SERVER carries metadata about the request and server environment — the HTTP method, headers, the requested path — commonly used to branch logic based on how a route was accessed (e.g. show a form on GET, process it on POST).

$_SESSION and $_COOKIE

<?php
session_start();
$_SESSION['user_id'] = 42;

echo $_SESSION['user_id']; // available on subsequent requests from the same browser

session_start() must be called before reading or writing $_SESSION — it's PHP's built-in mechanism for persisting data (like "is this user logged in") across multiple requests from the same visitor, backed by a session ID stored in a cookie. $_COOKIE reads cookies directly, while setcookie() sets one.

A full form-handling example

<?php
session_start();

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $name = trim($_POST['name'] ?? '');

    if ($name === '') {
        $error = "Name is required.";
    } else {
        $_SESSION['name'] = $name;
        header("Location: /welcome.php");
        exit;
    }
}

header("Location: ...") sends an HTTP redirect — it must be called before any other output has been sent to the browser, which is why exit immediately follows it: nothing after a redirect should still execute or try to print more output. This pattern (validate, then either show an error or redirect on success) is the backbone of virtually every traditional PHP form handler, before a framework's request/response abstractions take over the same job more safely.