Is it bad practice to write to $_POST?

Question

If this is file_1.php

<?php

  $_POST["test_message"] = "Hello, world";    

  header("Location: http://localhost/file_2.php");
?>

and this is file_2.php

<html>
<head>
</head>
<body>

<?php

  if (!(isset($_POST["test_message"])))
    echo "Test message is not set";
  else
    echo $_POST["test_message"];
?>

</body>
</html>

the output is Test message is not set

Which makes me wonder if one can even write to $_POST and, having wondered that, I wonder if it is bad practice to do so. Should I just let forms with submit buttons and method=post write to $_POST for me, or is it legitimate to write to $_POST to pass data between files?

not to mention if this is bad practice: it's simply not the way you can go to post data to another file, this won't work. — oezi, Jul 13 '10 at 08:19
it might not be bad practice if you're filtering the post data with one part of the app before another part of the app gets it and the two parts need to be completely decoupled. Otherwise, there's probably a better way to do whatever it is you're doing. — Dagg Nabbit, Jul 13 '10 at 08:24

score 18 · Accepted Answer · answered Jul 13 '10 at 08:16

You want to use $_SESSION instead.

$_POST is for information that has been POSTed to the current page and doesn't maintain state between page loads, it will only be populated if you actually post something to the second file when redirecting. If you were to include the second file, rather than redirecting via a header, then what you've done would work since the $_POST variable would still be set.

$_SESSION will maintain state between pages, so will accomplish what you want when redirecting.

To use $_SESSION properly, you'll need to call session_start(); first to begin the session. There's more info in the PHP manual.

score 6 · Answer 2 · answered Jul 13 '10 at 08:16

6

$_POST["test_message"] is blank in file2.php because you have not actually posted anything to that script. The $_POST array is populated by POSTing form data, you could populate $_GET by appending a GET variable to your header redirect or store data in $_SESSION if you need data persistence between pages.

answered Jul 13 '10 at 08:16

robjmills

18,438
15
77
121

are you saying that $_POST can only be written to from an HTML form with "emthod=post"? – Mawg says reinstate Monica Jul 13 '10 at 08:19
1

as the PHP manual says $_POST is "...An associative array of variables passed to the current script via the HTTP POST method." http://php.net/manual/en/reserved.variables.post.php – robjmills Jul 13 '10 at 08:21

score 3 · Answer 3 · answered Jul 13 '10 at 08:19

Look at it from the web server's perspective: it receives a request for file_1.php, runs that PHP file, and sends back the result, which happens to include a Location: header. Then some time later, it receives a separate request for file_2.php, so it loads and runs that file and sends back the result, which is an HTML page. The point is, the two files are used in completely separate HTTP requests. Each one is run in a separate environment, so for example, any changes that are made to variables in one are not reflected in the other one. The $_POST in the request for file_1.php is a separate variable from the $_POST in the request for file_2.php.

As far as your actual question: I think you can write to $_POST, but it's probably not recommended. That's not really what the variable is for.

+1 Thanks for making me think about it; that made it very clear. — Mawg says reinstate Monica, Jul 13 '10 at 08:43

score 3 · Answer 4 · answered Jul 13 '10 at 09:43

Generally spoken $_POST is just a regular PHP array that's populated with the POST data on each request. It's therefore possible to write your own values into $_POST.

But...

1) Your code doesn't work as your header() call in file_1.php instructs the browser to issue a new request which results in a completely new (and empty) $_POST array in file_2.php. The array will be empty because you didn't post anything to file_2.php.

2) In my opinion it's indeed bad practice... Getting data from $_POST (or $_GET or $_REQUEST) indicates that you're retrieving user data which should be handled with extreme caution (filtering, sanitizing, escaping,...). Writing internal data into these arrays will mix up internal and external data leading to confusion and probable security holes.

score 2 · Answer 5 · edited Sep 29 '11 at 13:12

It's absolutely fine to do that. If you look at all the big php frameworks (CI, cake, joomla etc), they all post via the index.php page thro' a controller to the final destination (usually using some helper code). Therefore, the $_POST variable is buried quite a few layers deep. Remember, the $_POST variable is ONLY valid for that transitory moment while the http request is active, so when the request is complete, all variables are reset to null.

The $_SESSION variable CAN be used if you want to persit between requests - tho it depends on your requirement and scenario.

score 1 · Answer 6 · answered Jul 13 '10 at 08:19

The $_POST should only be used with forms not like this:

$_POST["test_message"] = "Hello, world";

You also need to make sure that you avoid any security risks, use functions like stripslashes and mysql_real_escape_string (when inserting data in database)

To maintain state between pages, you need to use the sessions instead.

score 1 · Answer 7 · answered Jul 13 '10 at 11:07

Your example cannot work, see other's answer which explain why.

Furthermore using $_POST superglobal as a data storage is a pretty bad idea imho. Use specific variable sharing solution if you need (like database, im memory registry, session, cookie, etc)

Is it bad practice to write to $_POST?

7 Answers7

Linked