[RESOLVED] $_REQUEST vs $_POST

amy_damnit

What is the difference between using $REQUEST and $POST to handle form data?

I'm learning PHP using Larry Ullman's series of books, and in his beginning book he always used $POST, but now in his "PHP 6 and MySQL 5" book his started using $REQUEST?? 😕

Amy

LordShryku

$POST only has post variables while $REQUEST has post, get, and cookie variables.

amy_damnit

LordShryku;10915147 wrote:
$POST only has post variables while $REQUEST has post, get, and cookie variables.

I thought I read somewhere that using $REQUEST isn't as secure as using $POST??

Amy

laserlight

amy.damnit wrote:
I thought I read somewhere that using $REQUEST isn't as secure as using $POST??

Not really. The idea is that it is easier to manipulate the input with $GET than $POST, and since $REQUEST includes $GET, the same applies for $REQUEST. But whether you use $GET, $POST or $REQUEST, you still have to properly validate incoming data.

Oh, and welcome back, LordShryku.

amy_damnit

laserlight;10915150 wrote:
Not really. The idea is that it is easier to manipulate the input with $GET than $POST, and since $REQUEST includes $GET, the same applies for $_REQUEST.

Is it correct then that $REQUEST is a "parent" array that holds the three "child" arrays of $POST, $GET, and $COOKIE?

It sounds like it is better to just use $_POST for my form needs for now?

But whether you use $GET, $POST or $_REQUEST, you still have to properly validate incoming data.

Sure thing.

Amy

bradgrafelman

amy.damnit wrote:
Is it correct then that $REQUEST is a "parent" array that holds the three "child" arrays of $POST, $GET, and $COOKIE?

Yep; straight from the manual page [man]variables.request[/man]:

PHP Manual wrote:
Description

An associative array that by default contains the contents of $GET, $POST and $_COOKIE.

amy.damnit wrote:
It sounds like it is better to just use $POST for my form needs for now?

It depends; if you know that the data you want to process should come from a POST'ed form, then yes, you might as well just use $POST.

Using $REQUEST gives you the flexibility of examining the three sources at once, so whether someone POST'ed the data form a form, bookmarked it as a part of the URL (e.g. $GET would then contain it), or you saved it in a cookie, $_REQUEST will contain the data.

amy_damnit

Okay, thanks,

Amy

NogDog

The problem with $REQUEST is that if you receive a cookie named "foo" with a value of 1, a form POST value named "foo" with a value of 2, and a URL variable named "foo" with a value of 3; you will have only one $REQUEST['foo'] variable with either a value of 1, 2, or 3 depending on the current setting of a couple different configuration directives (request_order or variables_order).

Therefore $REQUEST is ambiguous as to the data source, whereas $GET, $POST, and $COOKIE are specific. The vast majority of the time the specific array is both completely sufficient and also helps remind you what the data source is when reading your code. The rare case where you actually need to use $_REQUEST will probably become self-evident should it ever arise. (I don't think I've ever used it.)

amy_damnit

NogDog,

Thanks for the additional post. Your explanation seemed to be the best! 😉

Amy

NogDog

What do I win? 🙂

amy_damnit

NogDog;10915243 wrote:
What do I win? 🙂

My undying respect and admiration! bats eyes at NogDog 😉

Amy
🙂