PHP GET

The $_GET superglobal collects values that arrive in the query string of a URL, making it ideal for links, search parameters, and bookmarkable pages.

How data reaches $_GET

When a URL contains a question mark followed by name-and-value pairs, that trailing section is called the query string. PHP parses it automatically and places each pair into the $_GET array, using the name as the key. A request for product.php?id=42&color=blue produces an array with an 'id' key holding "42" and a 'color' key holding "blue". These values always start life as strings.

Query strings are visible in the address bar, saved in browser history, and recorded in server logs. This makes $_GET a good fit for parameters that identify what a page should show, and a poor fit for anything sensitive such as passwords.

CharacteristicGET behaviour
Visible in URLYes, appears in the address bar
Can be bookmarkedYes
Length limitRestricted by browser and server URL limits
Good forSearch terms, filters, page identifiers
Not suitable forPasswords, tokens, or large payloads

Reading a value safely

Because a visitor can type any URL they like, you cannot assume an expected key is present. Check for it first, or supply a fallback with the null coalescing operator, then escape the value before displaying it.

Reading and escaping a query parameter

<?php
// URL example: greet.php?name=Ada
if (isset($_GET['name'])) {
    $name = htmlspecialchars($_GET['name']);
    echo "<h1>Hello, $name!</h1>";
} else {
    echo "<h1>Hello, stranger!</h1>";
}
?>

A form that sends data with GET

An HTML form whose method attribute is "get" appends its fields to the URL when submitted. This pattern is common for search boxes, since the resulting URL can be shared and revisited.

A search form using GET

<form method="get" action="search.php">
  <input type="text" name="q" placeholder="Search...">
  <button type="submit">Go</button>
</form>

<?php
// search.php reads the submitted term
$term = trim($_GET['q'] ?? '');
if ($term !== '') {
    echo "You searched for: " . htmlspecialchars($term);
}
?>
Note: Never trust the contents of $_GET. Validate that a value has the type and range you expect, and escape it with htmlspecialchars before echoing it into a page. Passing raw $_GET values into a database query without prepared statements is a classic SQL injection vulnerability.

When to choose GET

  • The action only reads data and does not change anything on the server
  • You want the resulting page to be bookmarkable or shareable via its URL
  • The parameters are short and not sensitive
  • You are building navigation links, filters, or pagination controls
Note: Use GET for safe, repeatable reads and POST for actions that create, update, or delete data. Reloading a GET page should never cause an unwanted side effect.