The Difference Between GET and POST in PHP (Complete)

When working with HTML forms and PHP, you'll often deal with two HTTP methods: GET and POST. Both are ways of sending data from the browser to the server, but they have very different characteristics. Understanding when to use GET and when to use POST is a fundamental skill that determines the security and correctness of your web application's design.

How GET Works

With the GET method, data is sent through the URL as a query string. You've probably seen URLs like this before:

https://example.com/products.php?category=books&page=2&sort=price

In PHP, GET data is read through the $_GET superglobal:

<?php
// URL: products.php?category=books&page=2

$category = $_GET['category'] ?? 'all';  // 'books'
$page     = (int) ($_GET['page'] ?? 1);  // 2

echo "Category: $category, Page: $page";

// Check whether the parameter exists
if (isset($_GET['sort'])) {
    $sort = htmlspecialchars($_GET['sort']);
    echo "Sorted by: $sort";
}

How POST Works

With the POST method, data is sent inside the HTTP request body — it isn't visible in the URL. In PHP, POST data is read through the $_POST superglobal:

<!-- HTML form with the POST method -->
<form action="process_login.php" method="POST">
    <input type="text"     name="username" placeholder="Username">
    <input type="password" name="password" placeholder="Password">
    <button type="submit">Login</button>
</form>

<?php
// process_login.php
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = trim($_POST['username'] ?? '');
    $password = $_POST['password'] ?? '';

    if (empty($username) || empty($password)) {
        echo "Username and password are required.";
    } else {
        // Process login...
        echo "Attempting to log in as: " . htmlspecialchars($username);
    }
}

GET vs POST Comparison Table

• Data visibility — GET: data is visible in the URL. POST: data is hidden in the request body.
• Security — GET: less secure for sensitive data. POST: more secure (though you still need HTTPS).
• Size limit — GET: limited (around 2048 characters depending on the browser/server). POST: much larger (configurable in php.ini).
• Bookmarkable — GET: yes. POST: no.
• Browser cache — GET: can be cached. POST: not cached.
• Browser history — GET: recorded. POST: not recorded.
• Idempotent — GET: yes (safe to repeat). POST: no (resending can duplicate data).

When to Use GET?

Use GET for:

• Product search and filtering (?q=laptop&price=min-5million)
• Page pagination (?page=3)
• Display parameters that may be bookmarked or shared
• Data requests that don't change state on the server (idempotent)

When to Use POST?

Use POST for:

• Login and registration forms, and submitting sensitive data
• Creating, updating, or deleting data in the database
• File uploads
• Data that must not appear in the URL or browser history

Reading the Request Method with $_SERVER

A clean way to handle forms is to check the request method first:

<?php

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // Process the submitted form
    $name  = trim($_POST['name'] ?? '');
    $email = trim($_POST['email'] ?? '');

    // Validation
    if (empty($name)) {
        $errors[] = "Name is required.";
    }
    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
        $errors[] = "Invalid email format.";
    }

    if (empty($errors)) {
        // Save to the database or process further
        echo "Data submitted successfully!";
    }
} else {
    // Display the form (GET request)
    // ... render the HTML form here
}

Using $_REQUEST

PHP also has $_REQUEST, which merges data from $_GET, $_POST, and $_COOKIE. However, using it is not recommended because:

• It's unclear where the data comes from.
• It can introduce security vulnerabilities if GET and POST mix unexpectedly.

Always use $_GET or $_POST explicitly, depending on your needs.

Input Validation and Sanitization

Whatever method you use, never trust data from users. Always validate and sanitize:

<?php

// Sanitize a regular string
$name = htmlspecialchars(trim($_POST['name'] ?? ''), ENT_QUOTES, 'UTF-8');

// Validate and filter an integer
$age = filter_input(INPUT_POST, 'age', FILTER_VALIDATE_INT, [
    'options' => ['min_range' => 1, 'max_range' => 120]
]);

// Validate an email
$email = filter_input(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);

// Validate a URL
$website = filter_input(INPUT_GET, 'redirect', FILTER_VALIDATE_URL);

if ($age === false) {
    echo "Invalid age.";
}

Conclusion

GET and POST serve different roles, and both are equally important. Use GET for data that may be visible in the URL and bookmarked, and use POST for sensitive data, submission forms, and operations that change data. Most importantly, always validate and sanitize all user input — whether from GET or POST — before processing it further.