PHP Query Parameters

How it works

Use $_GET for a field whose source is explicitly the query string. $_REQUEST can mix sources according to configuration and obscure which value won. A required scalar field needs a type check and a format/range rule. Returning a 422 response makes rejected input observable in this small JSON lab. No database or privileged operation is performed here.

Run it locally

Save this standalone lab file in a separate local folder. Start a PHP development server on an unused loopback port, for example php -S 127.0.0.1:8090 -t . . Open the shown filename through that server, not a file URL. Exercise GET and POST as described. This is not a POST endpoint on Bhylu, and the built-in development server is not a production server.

php -l query-input.php
php -S 127.0.0.1:8090 -t .

Download this source as a local PHP lab file. Keep lab files separate from the Bhylu project and production data.

Example

<?php
declare(strict_types=1);

header("Content-Type: application/json; charset=utf-8");
$raw = $_GET["days"] ?? "7";
$days = is_string($raw) ? filter_var($raw, FILTER_VALIDATE_INT, ["options"=>["min_range"=>1,"max_range"=>30]]) : false;
if ($days === false) { http_response_code(422); echo json_encode(["error"=>"Invalid days"]); exit; }
echo json_encode(["days"=>$days]);

Expected result

{"days":7}

A missing optional field uses a documented default. A valid supplied string becomes an integer; an array or invalid range is rejected before the response is built. The browser does not get an internal dump of the rejected structure. A mandatory field would need a different missing-value policy rather than silently defaulting to seven.

Requests to check

• GET query-input.php → status 200.
• GET query-input.php?days=30 → status 200.
• GET query-input.php?days=0 → status 422.
• GET query-input.php?days%5B%5D=7 → status 422.

Use a local browser form or HTTP client. A CSRF token from one session does not authorise a different session. The automated review uses actual HTTP requests, not just command-line output.