$_REQUEST behavior in PHP - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the $_REQUEST superglobal in PHP?

The $_REQUEST superglobal is an associative array in PHP that contains data from the GET, POST, and COOKIE input methods combined.

beginner

Which input types does $_REQUEST include by default?

By default, $_REQUEST includes data from $_GET, $_POST, and $_COOKIE arrays.

intermediate

How does PHP decide the order of variables in $_REQUEST?

PHP uses the 'request_order' or 'variables_order' configuration in php.ini to decide the order of GET, POST, and COOKIE variables in $_REQUEST.

intermediate

What happens if a variable name exists in both $_GET and $_POST when accessed via $_REQUEST?

The value that appears first in the 'request_order' or 'variables_order' configuration will be used in $_REQUEST, potentially overriding the other.

advanced

Why might relying on $_REQUEST be risky in PHP?

Because $_REQUEST mixes GET, POST, and COOKIE data, it can lead to security issues or unexpected behavior if variable names overlap or if the source of data is important.

Which of the following is NOT included in the default $_REQUEST array?

A $_GET

B $_POST

C $_COOKIE

D $_SESSION

$_SESSION data is not included in $_REQUEST; only $_GET, $_POST, and $_COOKIE are included by default.

If a variable 'user' exists in both $_GET and $_POST, which value does $_REQUEST['user'] hold?

A The $_GET value always

B The $_POST value always

C Depends on 'request_order' or 'variables_order' settings

D It holds both values as an array

The order of variables in $_REQUEST depends on the 'request_order' or 'variables_order' configuration in php.ini.

What PHP configuration directive controls the order of variables in $_REQUEST?

A request_order

B memory_limit

C max_execution_time

D post_max_size

'request_order' controls the order of GET, POST, and COOKIE variables in $_REQUEST.

Why should you be cautious when using $_REQUEST in your PHP code?

A It can mix data sources leading to security risks

B It does not contain any user input

C It is slower than $_GET or $_POST

D It only works with POST requests

$_REQUEST mixes GET, POST, and COOKIE data, which can cause security issues if not handled carefully.

Which superglobal should you use if you want to access only POST data?

A $_REQUEST

B $_POST

C $_GET

D $_COOKIE

Use $_POST to access only POST data, avoiding confusion from other sources.

Explain how PHP's $_REQUEST array is constructed and what configuration affects its behavior.

Think about which input sources are merged and how PHP decides which value to keep.

Describe potential risks of using $_REQUEST in PHP applications and how to avoid them.

Consider what happens when data from different sources overlap.

Practice

1. What does the PHP superglobal $_REQUEST contain?

easy

A. Data from GET, POST, and COOKIE combined

B. Only data sent via GET method

C. Only data sent via POST method

D. Only data stored in cookies

Solution

1. Step 1: Understand the purpose of $_REQUEST

   $_REQUEST is designed to collect data from multiple sources: GET, POST, and COOKIE.

2. Step 2: Identify what $_REQUEST includes

   It merges these three superglobals into one array for easier access.

3. Final Answer:

   Data from GET, POST, and COOKIE combined -> Option A

4. Quick Check:

   $_REQUEST = GET + POST + COOKIE [OK]

Hint: Remember: $_REQUEST mixes GET, POST, and COOKIE data [OK]

Common Mistakes:

• Thinking $_REQUEST only contains GET or POST data
• Confusing $_REQUEST with $_POST or $_GET
• Assuming $_REQUEST excludes cookies

2. Which of the following is the correct way to access a form field named username using $_REQUEST in PHP?

easy

A. $_REQUEST->username

B. request['username']

C. $_REQUEST.username

D. $_REQUEST['username']

Solution

1. Step 1: Recall PHP array syntax

   PHP superglobals like $_REQUEST are associative arrays accessed with square brackets and quotes for keys.

2. Step 2: Identify correct syntax for accessing 'username'

   The correct syntax is $_REQUEST['username']. Using arrows or dots is invalid for arrays.

3. Final Answer:

   $_REQUEST['username'] -> Option D

4. Quick Check:

   Array access uses brackets and quotes [OK]

Hint: Use square brackets with quotes for $_REQUEST keys [OK]

Common Mistakes:

• Using object notation (->) instead of array syntax
• Using dot notation like in JavaScript
• Forgetting quotes around the key

3. Given the following PHP code, what will be the output if the URL is script.php?color=red and the form sends color=blue via POST?

<?php
print_r($_REQUEST['color']);
?>

medium

A. red

B. Array

C. blue

D. Undefined index error

Solution

1. Step 1: Understand the order of variables in $_REQUEST

   By default, PHP's $_REQUEST uses the order: GET, POST, COOKIE. POST data overrides GET if keys are the same.

2. Step 2: Determine which value $_REQUEST['color'] holds

   Since POST sends color=blue, it overrides the GET color=red. So, $_REQUEST['color'] is 'blue'.

3. Final Answer:

   blue -> Option C

4. Quick Check:

   POST overrides GET in $_REQUEST [OK]

Hint: POST data overrides GET in $_REQUEST by default [OK]

Common Mistakes:

• Assuming GET value appears first
• Confusing $_REQUEST with $_GET or $_POST
• Expecting an array output

4. Consider this PHP snippet:

<?php
print_r($_REQUEST['user']);
?>

If the form sends no 'user' field and the URL has no 'user' parameter, what error will occur and how to fix it?

medium

A. No error; prints empty string

B. Notice: Undefined index; fix by checking with isset()

C. Warning: Invalid argument; fix by casting to string

D. Fatal error: Undefined variable; fix by declaring variable

Solution

1. Step 1: Identify the error from accessing missing key

   Accessing $_REQUEST['user'] when 'user' is not set causes a Notice: Undefined index.

2. Step 2: Fix by checking if key exists

   Use isset($_REQUEST['user']) before accessing to avoid the notice.

3. Final Answer:

   Notice: Undefined index; fix by checking with isset() -> Option B

4. Quick Check:

   Check keys with isset() to avoid notices [OK]

Hint: Always check isset() before accessing $_REQUEST keys [OK]

Common Mistakes:

• Ignoring undefined index notices
• Confusing undefined index with undefined variable
• Assuming no error occurs when key missing

5. You want to safely get a user's preferred language from either GET, POST, or COOKIE using $_REQUEST, but prefer POST over GET and GET over COOKIE. Which code snippet correctly respects this priority?

hard

A. if(isset($_POST['lang'])) { $lang = $_POST['lang']; } elseif(isset($_GET['lang'])) { $lang = $_GET['lang']; } elseif(isset($_COOKIE['lang'])) { $lang = $_COOKIE['lang']; } else { $lang = 'en'; }

B. $lang = $_REQUEST['lang'] ?? 'en';

C. $lang = $_COOKIE['lang'] ?? $_GET['lang'] ?? $_POST['lang'] ?? 'en';

D. $lang = $_GET['lang'] ?? $_POST['lang'] ?? $_COOKIE['lang'] ?? 'en';

Solution

1. Step 1: Understand priority order requirement

   The priority is POST > GET > COOKIE, so check in that order.

2. Step 2: Analyze each option's order

   if(isset($_POST['lang'])) { $lang = $_POST['lang']; } elseif(isset($_GET['lang'])) { $lang = $_GET['lang']; } elseif(isset($_COOKIE['lang'])) { $lang = $_COOKIE['lang']; } else { $lang = 'en'; } checks POST first, then GET, then COOKIE, assigning default 'en' if none set. $lang = $_REQUEST['lang'] ?? 'en'; uses $_REQUEST which merges but order depends on php.ini and is less explicit. Options C and D check in wrong orders.

3. Final Answer:

   Option A code snippet -> Option A

4. Quick Check:

   Explicit checks respect priority best [OK]

Hint: Check POST, then GET, then COOKIE explicitly for priority [OK]

Common Mistakes:

• Relying on $_REQUEST without knowing order
• Checking keys in wrong priority order
• Not providing a default value