PHP $_REQUEST Explained – Complete Beginner’s Guide with Examples

Introduction: Why Do We Need $_REQUEST in PHP?

When users interact with a website, data can be sent to the server using:

GET (URL parameters)
POST (form submission)
COOKIE (stored browser data)

PHP provides a shortcut to access all these data sources using one variable.

That variable is $_REQUEST.

What Is $_REQUEST in PHP?

Simple Definition

$_REQUEST is a PHP superglobal array that contains data sent by:

$_GET
$_POST
$_COOKIE

in a single place.

In Simple Words

Instead of checking GET or POST separately, $_REQUEST allows you to access request data using one array.

What Does “Superglobal” Mean?

A superglobal variable in PHP:

Is available anywhere in the script
Does not need global keyword
Works automatically

Examples of superglobals:

$_GET
$_POST
$_REQUEST
$_SESSION
$_COOKIE

Real-Life Analogy

Imagine receiving messages through:

Instead of checking each app, you get one inbox that shows all messages together.

That inbox is $_REQUEST.

PHP $_REQUEST Syntax

$_REQUEST['key']

Example:

$_REQUEST['username']

How $_REQUEST Collects Data

By default, $_REQUEST includes data from:

GET
POST
COOKIE

(The order depends on PHP configuration, usually GET → POST → COOKIE)

Example 1: Using $_REQUEST with GET

HTML Form

<form method="get" action="process.php">
    Name: <input type="text" name="username">
    <input type="submit">
</form>

PHP Code

<?php
echo $_REQUEST['username'];
?>

Example URL

process.php?username=John

Data accessed successfully
Works the same as $_GET['username']

Example 2: Using $_REQUEST with POST

HTML Form

<form method="post" action="process.php">
    Email: <input type="email" name="email">
    <input type="submit">
</form>

PHP Code

<?php
echo $_REQUEST['email'];
?>

Works like $_POST['email']
No need to check request type

Example 3: Checking If Data Exists

Wrong Way

echo $_REQUEST['name'];

Correct Way

if (isset($_REQUEST['name'])) {
    echo $_REQUEST['name'];
}

Prevents warnings
Safer code

Difference Between $_GET, $_POST, and $_REQUEST

Feature	$_GET	$_POST	$_REQUEST
Source	URL	Form body	GET + POST + COOKIE
Security	Low	Better	Depends
Control	High	High	Low
Recommended for forms	No	Yes	Limited

When Should You Use $_REQUEST?

Use $_REQUEST When:

You don’t care whether data comes from GET or POST
Writing small scripts or demos
Quick prototyping
Learning PHP basics

When NOT to Use $_REQUEST

Avoid $_REQUEST when:

Security is important
You need strict control over input source
Working on login, payment, or sensitive forms

Use $_POST instead.

Security Considerations

Because $_REQUEST can include COOKIE data, it can be risky.

Unsafe Code

echo $_REQUEST['username'];

Safe Code

$username = htmlspecialchars($_REQUEST['username']);
echo $username;

Prevents XSS attacks
Improves security

Common Beginner Mistakes

Assuming $_REQUEST Is Always Safe

It is not secure by default.

Using $_REQUEST for Passwords

Always use $_POST for sensitive data.

Forgetting Input Validation

Never trust user input blindly.

Best Practices

Use $_POST for sensitive forms
Use $_GET for search and filters
Use $_REQUEST only when necessary
Always validate and sanitize input
Prefer clarity over shortcuts

Frequently Asked Questions (FAQ)

Q1. Is $_REQUEST the same as $_GET?

No. $_REQUEST includes data from GET, POST, and COOKIE.

Q2. Which is safer: $_POST or $_REQUEST?

$_POST is safer because it only accepts form data.

Q3. Can $_REQUEST receive cookie values?

Yes, depending on PHP configuration.

Q4. Should beginners use $_REQUEST?

Yes, for learning—but not for secure applications.

Q5. Can I disable COOKIE data in $_REQUEST?

Yes, through PHP configuration (request_order).