phparraysmultidimensional-array

What is the $_REQUEST precedence?


PHP Superglobal variables

PHP has global variables which can be accessed within any scope of your script. Three of these variables ($_GET, $_POST, $_COOKIE) are stored within a fourth variable ($_REQUEST).

$_GET

An associative array of variables passed to the current script via the URL parameters.

Consider the following example in which a URL is sent and accessed.

http://www.example.com/myPage.php?myVar=myVal
echo $_GET["myVar"]; // returns "myVal"

$_POST

An associative array of variables passed to the current script via the HTTP POST method when using application/x-www-form-urlencoded or multipart/form-data as the HTTP Content-Type in the request.

An example of this being used is as follows.

<form action="somePage.php" method="POST">
    <input type="text" name="myVar" value="myVal" />
    <input type="submit" name="submit" value="Submit" />
</form>
echo $_POST["myVar"]; // returns "myVal"

$_COOKIE

An associative array of variables passed to the current script via HTTP Cookies

setcookie("myVar", "myVal", time() + 3600);
echo $_COOKIE["myVar"]; // returns "myVal"

$_REQUEST

An associative array that by default contains the contents of $_GET, $_POST and $_COOKIE.


Here's the thing

$_REQUEST contains all three in one array and is accessed via $_REQUEST["myVar"].

A random scenario

Let's assume, for whatever reason, that I use the same name for my $_GET, $_POST, and $_COOKIE.

What would the precedence be for what is stored in $_REQUEST.

Assuming I set a sent data through the URL, posted through the form and, set a cookie with the same name as each other (a bizarre scenario, I know).
Lets say I used the name "example".

What would be the output of the following output?

     if ($_REQUEST["example"] == $_GET["example"])    echo "GET";
else if ($_REQUEST["example"] == $_POST["example"])   echo "POST";
else if ($_REQUEST["example"] == $_COOKIE["example"]) echo "COOKIE";

tl;dr

If $_GET, $_POST, and $_COOKIE all have a value stored with the same name; which one will $_REQUEST store under said name?


Solution

  • In php.ini file there are 2 directives: request_order and variables_order

    request_order string

    This directive describes the order in which PHP registers GET, POST and Cookie variables
    into the _REQUEST array. Registration is done from left to right, newer values override 
    older values.
    
    If this directive is not set, variables_order is used for $_REQUEST contents.
    
    Note that the default distribution php.ini files does not contain the 'C' for cookies, 
    due to security concerns.
    

    and

    variables_order string

    Sets the order of the EGPCS (Environment, Get, Post, Cookie, and Server) variable 
    parsing. For example, if variables_order is set to "SP" then PHP will create the 
    superglobals $_SERVER and $_POST, but not create $_ENV, $_GET, and $_COOKIE. Setting 
    to "" means no superglobals will be set.
    
    If the deprecated register_globals directive is on, then variables_order also configures 
    the order the ENV, GET, POST, COOKIE and SERVER variables are populated in global scope. 
    So for example if variables_order is set to "EGPCS", register_globals is enabled, and both 
    $_GET['action'] and $_POST['action'] are set, then $action will contain the value of 
    $_POST['action'] as P comes after G in our example directive value.
    



    Taken from official documentation