GET & POST Methods

Introduction

In the previous two lessons you learned how to handle form submissions and validate the data a visitor sends. But every HTML form also has to decide how it sends that data to the server. That decision is made with the form's method attribute, and PHP gives you two matching superglobals to read the result: $_GET and $_POST.

This lesson focuses specifically on the difference between the GET and POST HTTP methods, how each one carries data from the browser to the server, and how to decide which one a given form should use.

What is an HTTP Method?

Every time a browser talks to a web server, it sends an HTTP request, and that request has a "method" describing what kind of action it represents. GET and POST are by far the two most common methods used with HTML forms, and PHP automatically separates their data into two different superglobal arrays.

The GET Method

With the GET method, form data is appended directly to the URL as a query string — the part after the ? symbol, with each field joined by &. Because the data lives in the URL, it is visible to the visitor, can be bookmarked, and can be shared as a link.

<form action="search.php" method="get">
    <input type="text" name="query" placeholder="Search...">
    <button type="submit">Search</button>
</form>

Submitting "php tutorials" produces a URL like search.php?query=php+tutorials. On the receiving page, that value is available in the $_GET superglobal.

<?php
if (isset($_GET["query"])) {
    $term = $_GET["query"];
    echo "You searched for: " . htmlspecialchars($term);
}
?>

You searched for: php tutorials

The POST Method

With the POST method, form data is sent in the body of the HTTP request instead of the URL. The visitor never sees the submitted values in the address bar, there is no practical size limit, and POST is the standard choice for anything sensitive or large.

<form action="login.php" method="post">
    <input type="text" name="username" placeholder="Username">
    <input type="password" name="password" placeholder="Password">
    <button type="submit">Log In</button>
</form>

<?php
if ($_SERVER["REQUEST_METHOD"] === "POST") {
    $username = $_POST["username"];
    // Never echo a raw password back to the page!
    echo "Welcome, " . htmlspecialchars($username) . "!";
}
?>

Welcome, rahul!

GET vs POST

Choosing the Right Method

The right method depends on what the form does, not personal preference. A useful rule of thumb: if the result should be bookmarkable and the data is not sensitive, use GET. If the form changes something on the server or handles sensitive or large data, use POST.

Example: A Search Form vs a Login Form

Putting it together, here is why a search form typically uses GET while a login form uses POST — both use the exact same PHP superglobal pattern, just with different data flowing through it.

<?php
// Search form (GET) — safe to expose in the URL, nice to bookmark
if (isset($_GET["query"])) {
    echo "Searching for: " . htmlspecialchars($_GET["query"]) . "\n";
}

// Login form (POST) — must stay out of the URL and browser history
if ($_SERVER["REQUEST_METHOD"] === "POST" && isset($_POST["username"])) {
    echo "Login attempt for: " . htmlspecialchars($_POST["username"]) . "\n";
}
?>

Searching for: laptop
Login attempt for: rahul

Common Mistakes

Best Practices

Frequently Asked Questions

Key Takeaways

Summary

GET and POST are the two workhorse HTTP methods behind almost every HTML form. GET keeps data visible in the URL and is ideal for bookmarkable, read-only requests like searches, while POST hides data in the request body and is the right choice for sensitive or large submissions like logins.

In this lesson, you learned how each method carries data, how to read it with $_GET and $_POST, and how to decide between them. Next, you will build on this by handling file uploads — a special case that always requires POST.