Understanding PHP Superglobals: $_POST

PHP superglobals are built-in variables that are always available in every scope of a script — you never have to declare them with global or pass them as arguments. They expose key information such as user input, server details, and environment variables. One of the most commonly used is $_POST, the array PHP fills with data sent in the body of an HTTP POST request.

This chapter explains what $_POST is, how to read values from it safely, how it differs from $_GET, and how to handle a real form end to end. For a wider tour of the related arrays, see PHP superglobals.

What Is $_POST?

$_POST is an associative array that collects form data submitted with method="post". The browser places each field in the request body (not the URL), and PHP parses that body into $_POST before your script runs. The keys are the name attributes of your form controls, and the values are whatever the user entered.

Because the data travels in the request body, $_POST is the right choice for sensitive or large payloads (passwords, long text, file uploads), for actions that change server state, and any time you don't want values appearing in the URL or browser history.

$_POST vs $_GET

Both arrays carry user input, but they map to different HTTP methods and have different trade-offs.

Use POST when the request changes data or carries secrets; use GET for safe, repeatable reads. See $_GET for the counterpart, or $_REQUEST if you need both.

How to Read a Value

Access a value by its field name, exactly as you would any array key:

$username = $_POST['username'];

$_POST is only populated after a form is submitted with POST. On the first page load it is an empty array, so reading a missing key triggers a warning. Always check that a key exists first — use isset() or PHP 7+'s null coalescing operator to supply a default:

<?php
// Safe: never errors, falls back to an empty string
$username = $_POST['username'] ?? '';

if ($username === '') {
  echo "Username is required.";
} else {
  echo "Hello, " . htmlspecialchars($username);
}
?>

The null coalescing operator ?? returns the right-hand value whenever the left side is unset or null, which is exactly the case before the form is submitted.

Security: Never Trust User Input

Everything in $_POST comes from the client and can be forged. Two rules keep you safe:

• Escape on output. Pass any value through htmlspecialchars() before printing it into a page to prevent cross-site scripting (XSS).
• Validate and sanitize on input. Use filter_var() to check formats (email, integer, URL), and use prepared statements for database queries to prevent SQL injection — never concatenate $_POST values directly into SQL.

<?php
$email = filter_var($_POST['email'] ?? '', FILTER_VALIDATE_EMAIL);

if ($email === false) {
  echo "Please enter a valid email address.";
}
?>

Example: A Complete Contact Form

The form below sends three fields to contact.php using the POST method. Each control has a unique name, which becomes its key in $_POST.

<form action="contact.php" method="post">
  <label for="name">Name:</label>
  <input type="text" id="name" name="name" />

  <label for="email">Email:</label>
  <input type="email" id="email" name="email" />

  <label for="message">Message:</label>
  <textarea id="message" name="message"></textarea>

  <input type="submit" value="Submit" />
</form>

In contact.php, first confirm the request actually used POST (so the same file can also serve the empty form), then read, validate, and escape each value:

<?php
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
  $name    = trim($_POST['name'] ?? '');
  $email   = filter_var($_POST['email'] ?? '', FILTER_VALIDATE_EMAIL);
  $message = trim($_POST['message'] ?? '');

  $errors = [];
  if ($name === '')      { $errors[] = "Name is required."; }
  if ($email === false)  { $errors[] = "A valid email is required."; }
  if ($message === '')   { $errors[] = "Message cannot be empty."; }

  if (!$errors) {
    // Safe to use the data — e.g. send an email or save to the database
    echo "Thanks, " . htmlspecialchars($name) . "! Your message was received.";
  } else {
    foreach ($errors as $error) {
      echo htmlspecialchars($error) . "<br>";
    }
  }
}
?>

Checking $_SERVER['REQUEST_METHOD'] is the standard way to tell whether the user is viewing the form or submitting it. For a deeper walkthrough, see PHP form handling and PHP form validation.

Reading Multiple Values

When several controls share a name ending in [] (checkboxes, multi-selects), PHP turns them into a nested array:

<input type="checkbox" name="colors[]" value="red">
<input type="checkbox" name="colors[]" value="green">

<?php
$colors = $_POST['colors'] ?? [];   // e.g. ['red', 'green']
foreach ($colors as $color) {
  echo htmlspecialchars($color) . "\n";
}
?>

Note that an unchecked checkbox sends nothing — so colors may be missing entirely, which is why the ?? [] default matters.

Conclusion

$_POST is the workhorse for receiving form data submitted in the request body. Reading from it is as simple as indexing an array, but production code must always guard against missing keys with ?? or isset(), validate input with filter_var(), and escape output with htmlspecialchars(). Combined with prepared statements for any database work, these habits let you accept user input without exposing your application to XSS or SQL injection.

Practice