Superglobals

Introduction

Every time a browser sends a request to a PHP script, it carries a lot of information along with it: form data, URL parameters, cookies, uploaded files, and details about the server itself. PHP makes all of this available through a special set of built-in arrays called superglobals.

This lesson introduces the most important superglobals, what kind of data each one holds, and why you must always treat their contents as untrusted input rather than data you can rely on blindly.

What Are Superglobals?

Superglobals are built-in PHP arrays that are automatically available in every scope of your script — inside every function, every class method, everywhere — without needing the global keyword or any special setup.

<?php
function showRequestMethod() {
    // No "global" keyword needed - $_SERVER is always visible
    echo "Method: " . $_SERVER["REQUEST_METHOD"] . "\n";
}

showRequestMethod();
?>

Method: GET

$_GET

$_GET is an associative array holding any values passed in the URL's query string — the part after the question mark, like ?id=42&sort=asc.

<?php
// Visiting page.php?id=42&category=books
echo "ID: " . $_GET["id"] . "\n";
echo "Category: " . $_GET["category"] . "\n";
?>

ID: 42
Category: books

$_POST

$_POST is an associative array holding data submitted through an HTML form using the POST method. Unlike $_GET, POST data is sent in the request body rather than visible in the URL.

<?php
// After submitting a form with fields named "username" and "email"
if (isset($_POST["username"])) {
    echo "Username: " . $_POST["username"] . "\n";
    echo "Email: " . $_POST["email"] . "\n";
}
?>

Username: alice
Email: alice@example.com

$_SERVER

$_SERVER holds information about the server environment and the current request: the request method, the requested URI, headers, and more.

<?php
echo "Request Method: " . $_SERVER["REQUEST_METHOD"] . "\n";
echo "Requested URI: " . $_SERVER["REQUEST_URI"] . "\n";
echo "Host: " . $_SERVER["HTTP_HOST"] . "\n";
?>

Request Method: GET
Requested URI: /page.php?id=42
Host: www.example.com

$_SESSION

$_SESSION stores data that should persist for a single visitor across multiple page loads — commonly used to keep someone logged in as they navigate a site. Sessions require calling session_start() before they can be used, which you will cover in more detail in a later lesson.

<?php
session_start();

$_SESSION["username"] = "alice";

echo "Logged in as: " . $_SESSION["username"] . "\n";
?>

Logged in as: alice

$_COOKIE

$_COOKIE holds small pieces of data the browser stores and sends back with every request to the same site — often used for remembering preferences or a visitor across separate browser sessions.

<?php
if (isset($_COOKIE["theme"])) {
    echo "Preferred theme: " . $_COOKIE["theme"] . "\n";
} else {
    echo "No theme preference saved yet.\n";
}
?>

Preferred theme: dark

$_FILES

$_FILES holds information about files uploaded through an HTML form, including each file's original name, size, temporary location on the server, and any upload errors.

<?php
if (isset($_FILES["avatar"])) {
    echo "Uploaded file: " . $_FILES["avatar"]["name"] . "\n";
    echo "Size: " . $_FILES["avatar"]["size"] . " bytes\n";
}
?>

Uploaded file: profile.jpg
Size: 204800 bytes

$_REQUEST

$_REQUEST is a combined array that typically includes values from $_GET, $_POST, and $_COOKIE all at once. It can be convenient, but because it does not tell you which source a value actually came from, most PHP developers prefer being explicit with $_GET or $_POST instead.

<?php
// Works whether "id" arrived via the URL or a form field
echo "ID: " . $_REQUEST["id"] . "\n";
?>

ID: 42

Never Trust Superglobal Input

Every value inside $_GET, $_POST, $_COOKIE, $_FILES, and $_REQUEST originates from the visitor's browser — and browsers can be controlled directly by anyone, including people intentionally trying to break or exploit your application.

The next few lessons will build directly on this idea — you will learn how to process form submissions safely and validate user input before trusting it.

Common Mistakes

Best Practices

Frequently Asked Questions

Key Takeaways

Summary

Superglobals are how PHP hands your script all the information that arrives with an HTTP request, from form fields to server details to uploaded files. They are available everywhere, which makes them convenient — but that same convenience means every value in them must be treated as untrusted until proven otherwise.

In this lesson, you toured the most important superglobals and why blind trust in them is dangerous. Next, you will put $_GET and $_POST to work by building and processing a real HTML form.