PHP Superglobal – $_GET

Welcome to The Coding College! In this guide, we’ll dive into the $_GET superglobal, an important tool in PHP for handling data sent via URL query strings. If you’re building web applications that rely on retrieving parameters from the URL, $_GET is an indispensable resource.

What is $_GET?

$_GET is a PHP superglobal variable that retrieves data from the query string of a URL. It is an associative array that stores key-value pairs, where the keys correspond to the names of query parameters and the values are their respective data.

Key Features:

• Used for retrieving data appended to the URL.
• Read-only and available globally within your script.
• Convenient for passing small amounts of non-sensitive data.

Syntax

$_GET['key_name']

Here, 'key_name' is the name of the query string parameter you want to access.

Example: Using $_GET

Example URL

<a href="welcome.php?name=John&age=25">Click Here</a>

PHP Script (welcome.php)

<?php
$name = $_GET['name'];
$age = $_GET['age'];

echo "Hello, $name! You are $age years old.";
?>

Output:

Hello, John! You are 25 years old.

Sending Data with $_GET

Data can be passed via URL parameters using a query string. The query string starts with a ? and separates key-value pairs with &. For example:

URL Example:

https://www.example.com/page.php?category=books&sort=price

Accessing Parameters:

<?php
$category = $_GET['category']; // Outputs: books
$sort = $_GET['sort'];         // Outputs: price

echo "Category: $category <br>";
echo "Sort by: $sort";
?>

Example: Dynamic Links with $_GET

You can create dynamic links by embedding query string parameters directly in the URL.

<?php
$product_id = 101;
$product_name = "Laptop";

echo "<a href='details.php?id=$product_id&name=$product_name'>View Details</a>";
?>

Clicking the link will send the user to:
details.php?id=101&name=Laptop

Validating $_GET Data

Since $_GET data can be manipulated by users, always validate and sanitize it to prevent vulnerabilities.

Example: Sanitizing Input

<?php
$name = htmlspecialchars($_GET['name'], ENT_QUOTES, 'UTF-8');
$age = (int) $_GET['age'];

echo "Hello, $name! You are $age years old.";
?>

Handling Optional Parameters

Sometimes, a query parameter may not always be present in the URL. Use isset() to check if the parameter exists before using it.

Example:

<?php
if (isset($_GET['name'])) {
    $name = htmlspecialchars($_GET['name']);
    echo "Hello, $name!";
} else {
    echo "Name not provided.";
}
?>

Use Cases for $_GET

1. Search and Filtering

<form method="get" action="search.php">
    <input type="text" name="query">
    <input type="submit" value="Search">
</form>

In search.php:

<?php
$query = htmlspecialchars($_GET['query']);
echo "You searched for: $query";
?>

2. Pagination

<a href="products.php?page=1">Page 1</a>
<a href="products.php?page=2">Page 2</a>

In products.php:

<?php
$page = isset($_GET['page']) ? (int) $_GET['page'] : 1;
echo "Displaying page: $page";
?>

Advantages of $_GET

1. Easy to Use: Data can be appended directly to the URL, making it simple to test and debug.
2. Bookmarked URLs: URLs with query parameters can be bookmarked and shared.
3. Minimal Overhead: Lightweight and efficient for small amounts of data.

Security Concerns

1. Visible Data

• $_GET exposes data in the URL, which can be viewed and modified by users. Avoid using it for sensitive information like passwords.

2. Injection Attacks

• Unsanitized $_GET data can be exploited for injection attacks (e.g., SQL injection). Always validate and sanitize user inputs.

Example: Preventing SQL Injection

<?php
$id = (int) $_GET['id']; // Cast to integer to prevent malicious input
$sql = "SELECT * FROM products WHERE id = $id";
?>

3. Cross-Site Scripting (XSS)

• An attacker could inject malicious scripts into query parameters. Use htmlspecialchars() to encode special characters.

Example:

<?php
$search = htmlspecialchars($_GET['search'], ENT_QUOTES, 'UTF-8');
echo "You searched for: $search";
?>

Comparison: $_GET vs $_POST

Best Practices for Using $_GET

1. Validate Input Data: Use functions like filter_var() or ctype_* to validate user inputs.
2. Sanitize Input Data: Prevent XSS attacks by escaping special characters with htmlspecialchars().
3. Limit Data Usage: Only use $_GET for non-sensitive, small amounts of data.
4. Check for Missing Parameters: Always use isset() to check if a parameter exists before using it.
5. Avoid Sensitive Data: Do not use $_GET to send sensitive information like passwords or personal data.

Conclusion

The $_GET superglobal is an essential tool for PHP developers, enabling easy access to data passed through URLs. It is particularly useful for search forms, filtering, and pagination. However, due to its visibility and potential vulnerabilities, it’s crucial to validate and sanitize all $_GET data to ensure security.

For more tips, tutorials, and insights into PHP and programming, visit The Coding College. Keep learning, and happy coding! 🚀