parse_str()

The PHP parse_str() function parses a URL query string (the part after the ? in a URL, such as name=John&age=35) and turns each key=value pair into an entry in an array. It is the inverse of http_build_query(): one builds a query string, the other takes it apart.

This page covers the function's syntax, a basic example, how it handles arrays and nested keys, URL decoding rules, and an important security note about its second argument.

Syntax

parse_str(string $string, array &$result): void

parse_str() takes two parameters:

• $string — the query string to parse, for example name=John&age=35.
• &$result — a variable, passed by reference, that the function fills with the parsed key/value pairs. It is overwritten with a fresh array on each call.

The function returns nothing (void); the parsed data is written into $result.

Note: in older PHP the $result argument was optional, and omitting it imported each pair directly into local variables. That behavior was deprecated in PHP 7.2 and removed in PHP 8.0 — $result is now required. Always pass it.

Basic example

Here $query holds a query string. parse_str() splits it on &, decodes each value, and stores the result in $output. The output is:

Array
(
    [name] => John Doe
    [age] => 35
    [gender] => male
)

Notice that John+Doe became John Doe: parse_str() applies the same URL decoding as urldecode(), so a + becomes a space and %XX escape sequences are expanded.

Parsing arrays and nested keys

Query strings often use [] to express arrays, exactly like HTML form fields named colors[] or user[name]. parse_str() understands this bracket notation and builds nested arrays automatically:

<?php
$query = 'colors[]=red&colors[]=blue&user[name]=Sam&user[age]=20';
parse_str($query, $output);
print_r($output);
?>

Output:

Array
(
    [colors] => Array
        (
            [0] => red
            [1] => blue
        )

    [user] => Array
        (
            [name] => Sam
            [age] => 20
        )

)

This is the same parsing PHP applies to $_GET and $_POST, which is why a form field named user[name] arrives as $_POST['user']['name'].

Reading the query string from a URL

A common pattern is to pull the query string out of a full URL with parse_url() and then hand it to parse_str():

<?php
$url = 'https://example.com/search?term=php&page=2';
parse_str(parse_url($url, PHP_URL_QUERY), $params);
print_r($params);
?>

Output:

Array
(
    [term] => php
    [page] => 2
)

For the query string of the current request you usually do not need parse_str() at all — PHP has already populated $_GET. Use parse_str() when the query string comes from somewhere else: a stored URL, an API response, or a webhook payload.

Security note

When the second argument is the result array (as shown above), parse_str() is safe and predictable. The danger only existed with the now-removed single-argument form, which injected variables straight into the local scope — untrusted input could overwrite existing variables (a variant of the old register_globals problem). Because PHP 8.0 removed that form, this footgun is gone in modern code, but you should still treat any value coming out of a query string as untrusted user input and validate it before use.

Related functions

• explode() — split a string on a delimiter when you need a flat list rather than key=value parsing.
• implode() — join array elements back into a string.
• str_getcsv() — parse CSV-formatted strings into arrays.
• PHP form handling — how $_GET and $_POST use this same parsing.

Practice