$_POST

$_POST holds the values from a form sent with method="post". Like $_GET, it is an array of strings (or nested arrays).

1
2
3
4
5
6
7

<?php
$_POST = ["username" => "isha", "remember" => "1"];

$username = $_POST["username"] ?? "";
$remember = isset($_POST["remember"]);

echo "$username, remember: " . ($remember ? "yes" : "no");

1

isha, remember: yes

When is $_POST filled?

PHP fills $_POST when the request body has the content type application/x-www-form-urlencoded or multipart/form-data. That covers normal HTML forms.

It is empty for requests that send JSON. For a JSON API, read the raw body:

1
2
3

<?php
$json = file_get_contents("php://input");
$data = json_decode($json, true);

See Working with JSON Data.

Check the method first

1
2
3
4
5

<?php
if ($_SERVER["REQUEST_METHOD"] !== "POST") {
    http_response_code(405);
    exit("Method not allowed");
}

A page that changes data should accept only POST. A visitor who simply opens the address (a GET) gets a clear refusal.

Nested and array values

1
2
3
4
5
6
7

<?php
$_POST = [
    "user" => ["name" => "Isha", "email" => "i@example.com"],
    "skills" => ["php", "sql"],
];

echo $_POST["user"]["name"] . " knows " . implode(" and ", $_POST["skills"]);

1

Isha knows php and sql

Limits

PHP stops reading very large requests. Two php.ini settings control it:

• post_max_size: the biggest allowed request body.
• max_input_vars: how many fields PHP will accept (1000 by default).

If a huge form silently loses fields, check max_input_vars.

Do not trust it

Everything in $_POST is chosen by the sender. A hostile request can include extra fields, skip fields, or send arrays instead of strings. Read only the keys you need, and validate each one.

1
2
3
4
5
6
7
8

<?php
$_POST = ["name" => "Isha", "is_admin" => "1"];

// Pick only the fields you expect
$allowed = ["name", "email"];
$data = array_intersect_key($_POST, array_flip($allowed));

print_r($data);

1
2
3
4

Array
(
    [name] => Isha
)

The extra is_admin field never reaches your code. This avoids a bug called mass assignment, where a visitor sets fields you never meant to expose.