$_REQUEST

$_REQUEST is one array that holds the contents of $_GET and $_POST (and, depending on settings, $_COOKIE).

1
2
3
4
5
6
7
8

<?php
$_GET = ["name" => "from-url"];
$_POST = ["email" => "from-form"];

// What $_REQUEST would contain, by default order "GP":
$request = array_merge($_GET, $_POST);

print_r($request);

1
2
3
4
5

Array
(
    [name] => from-url
    [email] => from-form
)

Which source wins?

If a key exists in more than one place, the order is set by the request_order setting in php.ini (or variables_order if that is empty). The usual default is "GP": GET first, then POST, and POST overwrites GET. The result depends on server configuration, so the same code can behave differently on two hosts.

Why you should avoid it

1. You lose track of where data came from. A value from the URL looks the same as one from a form. Actions that should be POST-only can be triggered through a link.
2. Configuration decides the behaviour, as shown above.
3. It weakens CSRF protection. If a “delete” action reads $_REQUEST["id"], an attacker can trigger it with a simple image link (GET) instead of needing a form.

Use the right array

1
2
3

<?php
$search = $_GET["q"] ?? "";            // reading: GET is fine
$title = $_POST["title"] ?? "";         // changing something: POST

Being explicit makes the code clear and safer.

Where you may still see it

Old scripts and some plugins use $_REQUEST to support both methods. When you meet it in someone else’s code, read the surrounding lines to learn which method is really expected.