Php $_REQUEST vs $_GET and $_POST

Question

Hello everyone. Can you please guide me which of the below code will be more efficient and fast.

$temp = $_REQUEST['s'];

OR

if (isset($_GET['s'])) {
  $temp = $_GET['s'];
}
else {
  $temp = $_POST['s'];
}

Thanks

Answer 1

Use REQUEST. Nobody cares about the speed of such a simple operation, and it's much cleaner code.

Answer 2

I would use the second method as it is more explicit. Otherwise you don't know where the variables are coming from.

Why do you need to check both GET and POST anyway? Surely using one or the other only makes more sense.

Answer 3

$_REQUEST, by default, contains the contents of $_GET, $_POST and $_COOKIE.

But it's only a default, which depends on variables_order ; and not sure you want to work with cookies.

If I had to choose, I would probably not use $_REQUEST, and I would choose $_GET or $_POST -- depending on what my application should do (i.e. one or the other, but not both) : generally speaking :

• You should use $_GET when someone is requesting data from your application.
• And you should use $_POST when someone is pushing (inserting or updating ; or deleting) data to your application.

Either way, there will not be much of a difference about performances : the difference will be negligible, compared to what the rest of your script will do.

Answer 4

Don't worry. But you should still use the second solution (plus an extra check for none of those variables existing), because there are security issues with $_REQUEST (since $_GET and $_POST aren't the only sources for that array).

There was a post about the problems with $_REQUEST yesterday, I believe. Let me go find it.

EDIT: Oh well, not directly a post, but here it is anyway: http://kuza55.blogspot.com/2006/03/request-variable-fixation.html

Answer 5

I'd suggest using $_POST and $_GET explicitly.

Using $_REQUEST should be unecessary with proper site design anyway, and it comes with some downsides like leaving you open to easier CSRF/XSS attacks and other sillyness that comes from storing data in the URL.

The speed difference should be minimal either way.

Answer 6

You are prematurely optimizing. Also, you should really put some thought into whether GET should be used for stuff you're POST-ing, for security reasons.

Answer 7

I only ever use _GET or _POST. I prefer to have control.

What I don't like about either code fragment in the OP is that they discard the information on which HTTP method was used. And that information is important for input sanitization.

For example, if a script accepts data from a form that's going to be entered into the DB then the form had better use POST (use GET only for idempotent actions). But if the script receives the input data via the GET method then it should (normally) be rejected. For me, such a situation might warrant writing a security violation to the error log since it's a sign somebody is trying something on.

With either code fragment in the OP, this sanitization wouldn't be possible.

Answer 8

if (isset($_GET['s'])) {
  $temp = $_GET['s'];
}
else {
  $temp = $_POST['s'];
}

Use that because it is safer and it won't make noticeable speed difference

Answer 9

I would use $_POST, and $_GET because differently from $_REQUEST their content is not influenced by variables_order.
When to use $_POST and $_GET depends on what kind of operation is being executed. An operation that changes the data handled from the server should be done through a POST request, while the other operations should be done through a GET request. To make an example, an operation that deletes a user account should not be directly executed after the user click on a link, while viewing an image can be done through a link.