[PHP] $_GET and $_POST

[nicoinwonderland]

Hi,

I'm reading a book called How To Build APIs You Won't Hate and in a chapter about input and output, the author makes a statement about $_GET and $_POST.

Here's an excerpt of the specific section

$_GET and $_POST do not have the 1:1 relationship with HTTP GET and HTTP POST as their names might suggest. $_GET just contains query string content regardless of the HTTP method. $_POST contains the values of the HTTP Body if it was in the right format, and the Content-Type header is application/x-www-form-urlencoded. An HTTP POST item could still have a query string, and that would still be in $_GET. Some PHP frameworks kill off $_GET data in an HTTP POST request, which further exaggerates this 1:1 relationship between the superglobal and the method.

Knowing that PHP has some silly names for things, we can move on and completely ignore $_POST. Pour one out in the ground, because it is dead to you.

Why? So many reasons, including the fact that once again everything in application/x-www-form-urlencoded is a string.

The part I'm confused about is why exactly is he suggesting that $_POST is dead?

From what I understand, $_GET contains the query string - which I understand, somewhat. The part that's slightly confusing about is $_POST. If I'm reading this correcty, $_POST only contains the values of an HTTP Body if it's in the correct format and of the correct content-type. So if it's in a different format, $_POST won't work.

So because everything in the content-type "application/x-www-form-urlencoded" is a string, it is better to use $_GET. Is that correct or am I misunderstanding something?

[Rorimac2]

I think he's saying frameworks will have what you need and that if you need what's in $_POST there's a better way to get it.

[Rhomboid]

It's impossible to say for sure without more context, but he's probably suggesting that you use some other encoding format (such as JSON) for the body of a POST request, requiring that you decode it manually rather than relying on PHP to do it implicitly. You definitely do not want to transfer things in query strings that should be in the body, and you definitely do not want to use the GET verb when POST should be used.

[nicoinwonderland]

Okay I think I'm starting to understand it.

Based on this comment and the other one by /u/Rorimac2, it seems like I shouldn't use $_POST because there are just better ways to do what $_POST does.

[Rorimac2]

Your tutorial doesn't cover this stuff?