PHP GET and POST — Complete Guide to HTTP Request Methods
In this tutorial, you will learn about PHP GET and POST. We cover key concepts, practical examples, and best practices to help you master this topic.
PHP handles HTTP GET and POST requests through $_GET and $_POST superglobals, enabling form processing, API endpoints, and user input handling for web applications.
What You'll Learn
By the end of this tutorial, you'll handle GET and POST requests, build HTML forms, validate and sanitize input, implement form submission handling, and choose between GET and POST appropriately.
Why GET and POST Matter
Every web application processes user input. GET retrieves resources and passes data via URLs. POST submits data with larger payloads and sensitive information. Choosing correctly is fundamental to web development.
Real-World Use
A search form uses GET (query in URL, bookmarkable). A registration form uses POST (password in body, not cached). A file upload form uses POST with multipart encoding.
GET/POST Learning Path
flowchart LR
A[Superglobals] --> B[GET/POST]
B --> C[Cookies]
C --> D[Sessions]
D --> E[JSON]
A --> F{You Are Here}
style F fill:#f90,color:#fff
GET Request
<?php
// URL: /search.php?q=php&page=2
$query = $_GET["q"] ?? "";
$page = (int)($_GET["page"] ?? 1);
echo "Searching for: " . htmlspecialchars($query) . " (page $page)";
POST Request
<?php
if ($_SERVER["REQUEST_METHOD"] === "POST") {
$name = trim($_POST["name"] ?? "");
$email = trim($_POST["email"] ?? "");
if (empty($name) || empty($email)) {
echo "Please fill all fields";
} else {
echo "Welcome, " . htmlspecialchars($name) . "!";
}
}
?>
<form method="POST">
Name: <input type="text" name="name"><br>
Email: <input type="email" name="email"><br>
<button type="submit">Submit</button>
</form>
Form Handling Pattern
<?php
$errors = [];
$data = [];
if ($_SERVER["REQUEST_METHOD"] === "POST") {
$data["username"] = trim($_POST["username"] ?? "");
$data["email"] = trim($_POST["email"] ?? "");
$data["age"] = filter_input(INPUT_POST, "age", FILTER_VALIDATE_INT);
if (strlen($data["username"]) < 3) {
$errors[] = "Username must be at least 3 characters";
}
if (!filter_var($data["email"], FILTER_VALIDATE_EMAIL)) {
$errors[] = "Invalid email address";
}
if ($data["age"] === false || $data["age"] < 0 || $data["age"] > 150) {
$errors[] = "Invalid age";
}
if (empty($errors)) {
// Process the valid data
echo "Registration successful!";
}
}
GET vs POST Decision
<?php
// GET: Safe, idempotent, bookmarkable
// Use for: search, filtering, pagination
// /products?category=electronics&sort=price
// POST: Not cached, no URL length limit
// Use for: login, registration, file uploads
// Sensitive data stays in request body
File Upload with POST
<?php
if ($_SERVER["REQUEST_METHOD"] === "POST" && isset($_FILES["avatar"])) {
$file = $_FILES["avatar"];
$allowedTypes = ["image/jpeg", "image/png"];
if (!in_array($file["type"], $allowedTypes)) {
die("Invalid file type");
}
$dest = "uploads/" . uniqid() . "_" . basename($file["name"]);
move_uploaded_file($file["tmp_name"], $dest);
echo "Uploaded to: $dest";
}
?>
<form method="POST" enctype="multipart/form-data">
<input type="file" name="avatar">
<button type="submit">Upload</button>
</form>
Common Mistakes
1. Trusting $_GET and $_POST Directly
Never use user input without sanitization. Always validate, filter, or escape before use.
2. Using GET for Mutations
GET requests should not change server state. Use POST for login, registration, delete operations.
3. Forgetting enctype for File Uploads
Forms with file inputs must have enctype="multipart/form-data". Without it, $_FILES is empty.
4. Not Checking Request Method
Scripts that Process POST data should verify $_SERVER["REQUEST_METHOD"] === "POST" to avoid processing on initial GET load.
5. Exposing Form Values in URL
Sensitive data in GET requests appears in server logs, browser history, and referrer headers.
Practice Questions
1. When should you use GET vs POST?
GET for safe, idempotent operations (search, filtering). POST for state-changing operations (login, registration, file upload).
2. How do you access form data in PHP?
For GET forms, use $_GET["field_name"]. For POST forms, use $_POST["field_name"]. Always check with isset or null coalescing.
3. What is the maximum URL length for GET requests?
No official limit, but browsers limit URLs to ~2000 characters. POST has no practical limit.
4. How do you handle multiple form fields with the same name?
Append [] to the name: results in $_POST["items"] being an array.
5. Challenge: Create a form that validates and processes a contact message using POST.
<?php
if ($_SERVER["REQUEST_METHOD"] === "POST") {
$name = trim($_POST["name"] ?? "");
$email = trim($_POST["email"] ?? "");
$message = trim($_POST["message"] ?? "");
$errors = [];
if (strlen($name) < 2) $errors[] = "Name required";
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) $errors[] = "Valid email required";
if (strlen($message) < 10) $errors[] = "Message must be 10+ characters";
if (empty($errors)) echo "Message sent!";
}
?>
FAQ
Built by the developers of DodaTech
Doda Browser, DodaZIP & Durga Antivirus Pro