Form action with parameters - parameters are not in $_GET or $_POST

Question

I am working with re-implementing a REST API for which client has no source code and is losing access to server...

I am finding the the caller is sending posts but without posted data. All of the parameters are specified in the URL or what would be the action if it were a posting form.

Like so:

"POST http://foo.com/api/rest/?method=users.add_user&token=foo&section=bar&group=baz HTTP/1.1" 200 605 "-" "-" 

To my surprise those parameters are neither in $_GET nor $_POST but only available in $_REQUEST.

Am I missing something here? Why aren't they in $_GET as part of the URL accessed? The obvious answer is "because this is a POST so GET is undefined"?

Can someone educate me on my misconceptions of those super-globals?

Answer 1

$_GET and $_POST are empty because you are using the POST protocol, but sending variables through the GET method (encoding them in the URL).

PHP is finding the POST method used, so it sets the information in the $_GET variable to nothing, then parses the variables sent in the form's POST data into the $_POST variable, ie: nothing.

The $_REQUEST variable on the other hand operates on a different mechanic where it will parse all variables from the request whether they came from cookies, multipart data, post, get, etc. Which is why you see them there.

Typically scripts and applications work off the $_REQUEST data anyway as it's a much more concise collection of all the data and since you can't technically ever have GET and POST data in the same request, you don't have to worry about collision between the data sets.