PHP Superglobals

How it works

$_GET, $_POST, $_COOKIE, $_FILES, $_SERVER and $_SESSION have different sources and trust rules. $_REQUEST can combine configured sources, while $GLOBALS exposes global variable bindings rather than a clean dependency interface. A server variable can still contain visitor-controlled content such as a Host header. The local fixture below demonstrates why a typed parser should not care which transport supplied a value.

Run it locally

Run this complete source locally with PHP 8.2 or newer. Save it using the filename shown and run the command below. PHP is not currently available in Bhylu’s browser playground. Apache and MySQL are not needed for an ordinary CLI example.

php -l superglobals.php
php superglobals.php

Download this source as a local PHP lab file. Keep lab files separate from the Bhylu project and production data.

Example

<?php
declare(strict_types=1);

function parsePage(array $query): int {
    $raw = $query["page"] ?? "1";
    $page = is_string($raw) ? filter_var($raw, FILTER_VALIDATE_INT, ["options"=>["min_range"=>1,"max_range"=>1000]]) : false;
    if ($page === false) throw new InvalidArgumentException("Invalid page");
    return $page;
}
echo parsePage(["page"=>"3"]), "\n";
echo parsePage([]), "\n";

Expected result

3
1

The parser accepts an explicit array, so it can be tested without changing global request state. A web entry point could call it with $_GET, while a CLI test supplies a fixture. The default and maximum are now visible parts of one contract rather than duplicated assumptions throughout the application.