Processing GET Requests in PHP: A Beginner’s Guide

Previously in this course, we established our project structure strategy to separate our logic from our presentation. Now that we have a clean architecture, we need a way to make our pages dynamic. Instead of building a unique file for every single product or user profile, we use query parameters to tell our application which specific data to display.

Understanding the $_GET Superglobal

In PHP, the $_GET superglobal is an associative array that automatically captures data passed via the URL's query string. A query string begins with a ? character, followed by key-value pairs separated by &.

For example, if a user visits product.php?id=42&category=electronics, PHP populates the $_GET array like this:

PHP
$_GET = [
    'id' => '42',
    'category' => 'electronics'
];

Because $_GET is a superglobal, it is accessible from any scope in your application, including inside functions or methods.

Accessing and Sanitizing URL Input

The golden rule of web development is: never trust user input. Query parameters are easily manipulated by users. Before you use these values in your application logic, you must ensure they are safe.

At a minimum, you should check if the key exists before accessing it and sanitize the output to prevent Cross-Site Scripting (XSS).

Worked Example: A Dynamic Product Page

Let's implement a simple dynamic page in our project. We will check if an id is provided and use it to display a product name.

PHP
<?php
#6A9955">// product.php

#6A9955">// 1. Check if 'id' exists in the URL
if (isset($_GET['id'])) {
    
    #6A9955">// 2. Sanitize the input
    #6A9955">// We cast to an integer because product IDs should be numeric
    $productId = (int)$_GET['id'];
    
    #6A9955">// 3. Logic to fetch data(mocking a database lookup)
    $products = [
        1 => 'Mechanical Keyboard',
        42 => 'Wireless Mouse',
        105 => 'USB-C Cable'
    ];
    
    $productName = $products[$productId] ?? 'Product not found';
    
    #6A9955">// 4. Sanitize output before displaying to the browser
    echo "<h1>Product: " . htmlspecialchars($productName) . "</h1>";
    
} else {
    echo "<h1>Please select a product.</h1>";
}

If a user visits product.php?id=42, the page renders "Product: Wireless Mouse." If they visit without an ID, they see the fallback message.

Hands-on Exercise

Modify your current project's entry point or a new test script to accept a name parameter in the URL.

1. Create a variable $name = $_GET['name'] ?? 'Guest';
2. Use htmlspecialchars() to sanitize the input.
3. Echo a greeting like "Hello, [name]!" to the screen.
4. Test it by navigating to your local server URL with ?name=YourName appended to the end.

Common Pitfalls

• Assuming Keys Exist: Accessing $_GET['id'] without checking isset() will trigger a notice if the parameter is missing. Always use the null coalescing operator (??) or isset() to handle missing keys gracefully.
• Trusting the Data Type: Remember that everything in $_GET arrives as a string. If you expect a number, cast it explicitly using (int) or use filter_var().
• Directly Outputting Input: Never echo $_GET['data'] directly. If a user visits page.php?name=<script>alert('xss')</script>, your page will execute that script in the browser. Always use htmlspecialchars() when rendering user-supplied data to the HTML document.

FAQ

Is it safe to use $_GET for passwords? Absolutely not. GET parameters are stored in browser history, server access logs, and potentially referer headers. Sensitive data like passwords or tokens must never be sent via URL parameters; use $_POST instead, which we will cover in the next lesson.

What is the difference between filtering and sanitizing? Sanitizing removes unsafe characters (like stripping HTML tags), while validation checks if the data matches the expected format (e.g., checking if an email address is valid). You should do both.

How do I handle multiple parameters? Simply chain them in the URL: page.php?key1=val1&key2=val2. PHP will automatically parse these into the $_GET associative array.

Recap

We’ve learned that $_GET is the standard way to retrieve data from the URL, allowing us to build dynamic, data-driven pages. By verifying the existence of keys, casting data to the correct types, and sanitizing output with htmlspecialchars(), we maintain a secure application structure. These practices are essential as we move toward handling more sensitive user interactions.

Up next: Handling POST Requests