Superglobals, Form Handling & Input Sanitization

In Plain English

PHP provides superglobal arrays accessible everywhere in script execution scope. Learn request routing via $_GET and $_POST, server metadata via $_SERVER, and how to protect against XSS and injection attacks using htmlspecialchars() and filter_var().

The Mental Model

"Superglobals are like global environmental sensors wired directly into the cockpit dashboard. No matter what function you are flying inside, the sensor for outside altitude ($_GET) or engine pressure ($_SERVER) is instantly readable."

Deep Dive: How It Works

Superglobal Arrays: $_GET, $_POST, $_REQUEST, $_SERVER, $_SESSION, $_COOKIE, $_FILES, and $_ENV.

$_SERVER: Contains request headers, paths, client IP ($ _SERVER["REMOTE_ADDR"]), and HTTP method ($_SERVER["REQUEST_METHOD"]).

XSS Prevention: htmlspecialchars($input, ENT_QUOTES, "UTF-8") converts dangerous HTML characters (<, >, &, ") into safe HTML entities.

Data Validation: filter_var($email, FILTER_VALIDATE_EMAIL) checks for RFC-compliant email formatting.

Syntax Blueprint

<?php

$rawUser = $_POST["username"] ?? "";
$safeUser = htmlspecialchars($rawUser, ENT_QUOTES, "UTF-8");
$isValidEmail = filter_var($email, FILTER_VALIDATE_EMAIL);

Retrieve request variables with null fallback and sanitize with htmlspecialchars / filter_var.

Core Rules to Remember

Always Available: Superglobals are available in all scopes without declaring global $variable.

Never Trust User Input: Always validate and sanitize all values from $_GET, $_POST, and $_COOKIE before rendering or storing.

Filter Var Extensions: filter_var supports IP, URL, Email, Int range, and Boolean sanitization and validation flags.

Common Beginner Traps & How to Fix Them

Mistake:Directly echoing unescaped $_GET parameters: echo "Hello " . $_GET["name"];.

Why it happens: Allows attackers to inject malicious JavaScript (<script>alert(1)</script>) resulting in Cross-Site Scripting (XSS).

How to fix: Always wrap user output in htmlspecialchars($input, ENT_QUOTES, "UTF-8").

Pro Tip: Use filter_input(INPUT_POST, "email", FILTER_VALIDATE_EMAIL) for clean one-step retrieval and validation.

Live Interactive Example

Hit Run Code to see it live

Simulating Form Input Validation and Sanitization

PHP 8.2 / CLI

Output Console

Click "Run Code" to view the rendered output.

How it works: htmlspecialchars converted dangerous HTML tags into safe entities, and filter_var validated email and age.

Your Turn: Micro Challenge

No pressure! Edit the starter code below and test your solution with instant feedback.

Micro Exercise

Sanitize and Validate User Email

Declare $inputEmail = "[email protected]".
Use filter_var with FILTER_VALIDATE_EMAIL to test if $inputEmail is valid.
If valid, print "Valid Email: [email]", otherwise print "Invalid Email".

Sandbox Output

Click "Run & Check" to test your solution.

Finished reading and practicing?

Mark this lesson as completed to update your course progress.