Understanding PHP Superglobals: The $_REQUEST Variable

The PHP language has many built-in variables, called superglobals, that provide a convenient way to access data from various sources in your scripts. One of the most commonly used superglobals is the $_REQUEST variable, which combines the values of the $_GET, $_POST, and $_COOKIE variables into a single array.

In this article, we will delve deeper into the $_REQUEST variable, exploring its properties, use cases, and best practices for working with it in your PHP scripts.

What is the $_REQUEST Variable?

The $_REQUEST variable is a PHP superglobal — an associative array that is automatically available in every scope of your script. It contains data submitted to the server through various means, such as GET and POST requests, or cookies. It combines the data from the $_GET, $_POST, and $_COOKIE variables into a single array.

The order in which these sources are merged is controlled by the request_order and variables_order directives in php.ini. This matters because if the same key exists in more than one source, the last source listed in request_order wins. The default on most modern installations is GP (GET, then POST), meaning POST values overwrite GET values with the same name, and cookies are not included at all:

; php.ini
request_order = "GP"   ; only $_GET and $_POST feed $_REQUEST

Because this behavior depends on server configuration, never assume $_REQUEST contains cookie data unless you have verified the request_order setting.

When to Use the $_REQUEST Variable

The $_REQUEST variable is useful when you want to access data submitted by the client, regardless of the method used. For example, if you want to process a form submitted by the user, you can use the $_REQUEST variable to access the values submitted in the form, without having to know whether the form was submitted using the GET or POST method.

While $_REQUEST can include cookie data, it is standard practice to access cookies directly via $_COOKIE for better clarity and security.

How to Access Data in the $_REQUEST Variable

To access the data in the $_REQUEST variable, you simply use the array notation, providing the key that corresponds to the value you want to retrieve. For example, if you have a form with a text field named "username", you can access the value submitted in the field as follows:

Basic example of reading a value

$username = $_REQUEST['username'];
// Always validate and sanitize input before use

Because a key may be missing (for example, on the first page load before a form is submitted), check that it exists first. The null coalescing operator (??) is the cleanest way to supply a default:

$username = $_REQUEST['username'] ?? 'guest';
echo "Hello, " . htmlspecialchars($username);

If you forget the existence check and the key is absent, PHP emits an Undefined array key warning — so always guard your reads.

A complete form example

The real value of $_REQUEST is that the same handler works whether the form uses method="get" or method="post". The example below renders a form and processes its input regardless of method:

<?php
// handler.php
if (isset($_REQUEST['name'])) {
    // Never trust raw input — escape it before output
    $name = htmlspecialchars(trim($_REQUEST['name']));
    echo "Welcome, {$name}!";
}
?>

<form method="post" action="handler.php">
    <input type="text" name="name" placeholder="Your name">
    <button type="submit">Submit</button>
</form>

Switch method="post" to method="get" and the PHP code does not change — that is precisely the convenience $_REQUEST offers.

$_REQUEST vs $_GET vs $_POST

For more on the dedicated arrays, see the $_GET and $_POST chapters, and PHP form handling for end-to-end examples.

Best Practices for Working with the $_REQUEST Variable

When working with the $_REQUEST variable, it's important to follow some best practices to ensure that your scripts are secure and reliable. Some of the best practices for working with the $_REQUEST variable include:

• Validate and sanitize all data received from the client to ensure it is safe to use in your scripts.
• Prefer specific superglobals like $_GET or $_POST when the request method is known, as $_REQUEST is generally discouraged in modern PHP due to potential parameter pollution and ambiguity.
• Avoid using the $_REQUEST variable when handling sensitive data, such as passwords or other confidential information, to prevent security risks.
• Use PHP's filter functions (for example filter_input() or filter_var()) to validate and sanitize input in a structured, reusable way.
• For cookies, read $_COOKIE directly; for session data use $_SESSION — neither belongs in request-pollution-prone code paths.

Conclusion

The $_REQUEST variable provides a unified way to access client data regardless of the submission method. By understanding its configuration dependencies, potential ambiguities, and security best practices, you can use it effectively in your PHP scripts. While modern development often favors explicit $_GET or $_POST usage, $_REQUEST remains a useful tool for handling mixed input sources when configured correctly.

Practice