Understanding PHP Superglobals $_GET

PHP provides several superglobals that make it easy to read information from different sources in a simple, unified way. One of these is $_GET — the array PHP fills with the data found in the query string of the current request's URL. This chapter explains what $_GET contains, how PHP populates it, how to read it safely, and when to reach for it instead of $_POST.

What is $_GET?

$_GET is a PHP superglobal: an associative array that is automatically available in every scope (inside functions, classes, and files) without needing the global keyword. PHP fills it with the name/value pairs found after the ? in the request URL — the query string. The keys are the parameter names and the values are their (URL-decoded) contents.

Because the data lives in the URL, it is visible, bookmarkable, and shareable. That makes $_GET ideal for things a user might want to link to — a search query, a page number, a product ID — and a poor choice for anything sensitive or large.

How does $_GET work?

You pass variables by appending them to the URL as query parameters, in key=value pairs separated by &:

http://example.com/script.php?greeting=hello&lang=en

When the script runs, PHP parses the query string and populates $_GET. The resulting array looks like this:

// $_GET after the request above
[
    'greeting' => 'hello',
    'lang'     => 'en',
]

The values are always strings (or arrays — see below), even when they look numeric. ?page=2 gives you the string "2", not the integer 2, so cast or validate before doing arithmetic.

How to read $_GET safely

Always check that a key exists before using it — a missing parameter triggers a warning and gives you null. Use isset() or the null coalescing operator ??:

<?php
// Defensive read with a default value
$greeting = $_GET['greeting'] ?? 'Hi';
echo htmlspecialchars($greeting);   // safe to print in HTML

Data in $_GET comes straight from the client, so never trust it. Validate and sanitize before use:

<?php
// Validate that "id" is a positive integer
$id = filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT);

if ($id === false || $id === null) {
    echo 'Invalid or missing id';
} else {
    echo "Loading product #$id";
}

When echoing user input back into a page, run it through htmlspecialchars() to prevent cross-site scripting (XSS). When using it in SQL, use prepared statements rather than concatenating it into the query. See filter_input() and filter_var() for the full set of validation filters.

Retrieving form data with GET

An HTML form whose method is get submits its fields as query parameters, which then appear in $_GET:

<form action="search.php" method="get">
    <input type="text" name="q" placeholder="Search...">
    <button type="submit">Search</button>
</form>

Submitting apple sends the browser to search.php?q=apple, and in search.php:

<?php
$query = trim($_GET['q'] ?? '');

if ($query !== '') {
    echo 'Results for: ' . htmlspecialchars($query);
} else {
    echo 'Please enter a search term.';
}

For a deeper walkthrough see PHP Form Handling and PHP Form Validation.

Array and grouped parameters

Repeat a name with [] and PHP groups the values into a sub-array — handy for checkboxes and multi-select filters:

http://example.com/filter.php?color[]=red&color[]=blue

<?php
// $_GET['color'] is now an array: ['red', 'blue']
foreach ($_GET['color'] ?? [] as $color) {
    echo htmlspecialchars($color) . PHP_EOL;
}

GET vs POST

Use GET for reading — requests that don't change server state and that the user may want to repeat or share. Use POST for writing — submitting passwords, creating records, or sending large payloads. If you need a single point that reads from either method, see $_REQUEST.

Common uses

• Search results — put the query in the URL so users can bookmark or share their results.
• Dynamic pages — pass a ?id= or ?page= parameter to control which content is rendered.
• Filtering and sorting — encode the active filters in the URL so the state survives a refresh.

Conclusion

$_GET gives you a simple, unified way to read data passed in the URL's query string. It shines for shareable, read-only requests like searches and pagination, but because its values are visible and come from the client, always validate, sanitize, and escape them before use. For data that changes server state or must stay private, reach for $_POST instead.

Practice